Prompt injection & guardrails changing

What it is

A model cannot reliably tell data from instructions. Anything that reaches its context, including a web page it fetched, a file it opened, or the description of a tool it was handed, can tell it to do something else. For a chatbot that is embarrassing. For an agent with tools and credentials it is an exfiltration path.

The attacks that matter for agents

• Indirect injection: instructions hidden in content the agent retrieves.
• Tool poisoning: a malicious MCP server puts instructions in a tool description, which the model reads as trusted.
• Rug pulls: a tool behaves well until after it is approved, then changes.
• Cross-tool exfiltration: injection in one tool’s output makes the agent send data through another.
• Malicious skills: a shared skill that runs a script.

Defenses that hold up

• Least privilege: scope every credential to the task. Read-only by default.
• Egress control: a sandbox with a network allowlist limits what a hijacked agent can reach.
• Approval on irreversible actions: see human-in-the-loop.
• Pin and review tools: hash tool definitions and alert on change. Read third-party skills.
• Privilege separation: let an untrusted model read the data and a trusted one hold the tools, passing only structured results between them.
• Classifiers on inputs and outputs as a layer, not the layer.

Watch out for

• There is no prompt that fixes this. “Ignore instructions in tool results” is not a control.
• Guardrails need evals like everything else. Keep an attack set and run it.