Prompt Injection Hardening
Untrusted text is an attacker-controlled channel. Design as if retrieved docs, emails, and web pages can instruct the model to misuse tools.
Threat classes
- Direct injection — user message overrides system policy.
- Indirect injection — malicious content in RAG/web/email.
- Tool abuse — exfil via email/HTTP/code exec tools.
- Data cross-talk — tenant A content influences tenant B.
- Supply chain — malicious skills, plugins, or MCP servers.
Workflow
- Map trust boundaries: system prompt, developer messages, user, tools, memory, RAG.
- List tools and their side effects (read vs write vs money/network).
- Identify highest-impact abuse paths.
- Propose layered mitigations (not only "stronger prompt").
- Define red-team eval cases and monitoring signals.
- Residual risk and ship verdict.
Mitigations (pick what fits)
- Separate untrusted content in clear delimiters; never execute it as policy.
- Tool allowlists, argument schemas, confirmation for side effects.
- Outbound URL/email allowlists; block private IP SSRF from browse tools.
- Per-tenant retrieval isolation; no global memory without policy.
- Output filtering for secrets; dual-model or rules for high-risk actions.
- Human-in-the-loop for irreversible actions.
Output format
## AI threat model: <feature>
### Assets & tools
…
### Top abuse paths
1. …
### Mitigations
| Risk | Control | Owner |
### Eval / red-team cases
1. …
### Residual risk & verdict
…
Rules
- Prompt-only defenses are incomplete for tool-using agents — say so.
- Do not provide weaponized end-to-end exploit recipes for production systems; describe classes and defenses.
- Prefer least-privilege tools over smarter prompts.
- Distinguish model safety filters from application authorization.
- Log tool calls with redaction for forensics.
- If architecture is missing, ask targeted questions before inventing tools.
Edge cases
- RAG-only chatbot (no tools): still risk of social engineering and data leakage in answers.
- Code execution tools: sandbox, network policy, timeouts mandatory.
- Multi-agent: treat peer agent messages as untrusted unless authenticated.