No prompt or classifier reliably stops prompt injection. What does work is architecture: limiting what an agent can reach, keeping private data, untrusted content and outbound channels apart, and putting approvals on side effects. A practical checklist mapped to the OWASP Top 10 for LLM Applications.
Prompt injection is first on the OWASP Top 10 for LLM Applications, and it has not been solved. Any text the model reads (a web page, an email, a PDF, a tool result, a code comment) can contain instructions, and the model has no reliable way to tell your instructions from an attacker's. Guardrail classifiers catch some attacks and miss others. Treat them as a layer, not a defense.
Simon Willison named the combination that turns injection into data theft: an agent with access to private data, exposure to untrusted content, and a way to communicate externally. With all three, an instruction hidden in a web page can tell the agent to read your data and send it somewhere. Remove any one leg and the attack mostly fails. Most of the defenses below are ways of removing a leg.
Book a free 30-minute call. You'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Least privilege for tools. An agent that summarises tickets does not need a tool that sends email. OWASP calls the opposite Excessive Agency (LLM06).
Split agents by trust. One agent reads untrusted content and produces structured output with no tools; another, which never sees the raw content, acts on that output.
Restrict egress. If the agent's runtime can only reach an allow-list of hosts, data cannot be sent anywhere else, whatever the model is told. On AWS that is a VPC with no general internet route and endpoints only for what is needed.
No rendering of model-generated links or images in privileged contexts. A markdown image URL is an exfiltration channel.
Approval on side effects, shown from structured data rather than the model's summary.
Credentials scoped per user and per action, so an injected instruction can only do what that user could do anyway.
Log every tool call with its inputs, and alert on unusual sequences: reading many records followed by an outbound call is a pattern worth a human look.
Each MCP server you connect adds tools, and their descriptions and results are text the model reads. A third-party server can inject instructions through a tool description or a result. Pin server versions, review tool descriptions on update, run servers with their own narrowly scoped credentials, and do not connect a server that reads untrusted content to an agent that also holds sensitive tools.
Once a month: what changed in tech that month and what it means for you, from cloud and AI to security and the tools you build with. Every item links to its source. No sales pitch, unsubscribe in one click.
Book a free 30-minute call about it. Bring your setup and your bill; you'll leave knowing what we'd do first and roughly what it costs, whether or not you hire us.
Or keep reading
MCP in Production on AWS: Giving Agents Tools Without Giving Away the Keys
The Model Context Protocol made connecting agents to tools easy, which is exactly the problem. The risks that matter in production (tool output as an injection channel, over-broad tokens, unreviewed servers) and how Gateway, Identity and Policy on AgentCore, or your own controls, contain them.
Read
What MCP Is: Hosts, Clients, Servers, Tools, and How Sign-In Works
MCP (the Model Context Protocol) is the standard way an AI application connects to tools and data: Claude, ChatGPT, Cursor and VS Code speak it, and any company can publish a server. MCP explained in plain terms: the parts, what a server exposes, the two transports, how authorization works since the 2026 spec, where the security risks are, and when building a server is worth it.
Read
As of October 25, 2026. Provided as is, for general information, and accurate to the best of our knowledge on the date shown. Not legal, compliance, tax, financial or other professional advice. Prices, limits and vendor services change; check current vendor documentation before relying on anything here. Terms of use.