Can a system prompt stop prompt injection?

Scope

This guide applies when an agent reads content that is not fully trusted: web pages, email, tickets, documents, retrieved chunks, tool output, or messages from another agent. The risk becomes consequential when the same run can also access secrets, private data, or tools with side effects.

Why it happens

Language models process instructions and data through the same representation. Delimiters and hierarchy cues can influence behavior, but they do not transform external prose into inert bytes. An attacker can place an instruction where the agent expects evidence, or design content that manipulates a later summarization, routing, or tool-selection step.

The most dangerous architecture asks the model to both interpret untrusted content and decide whether to use broad credentials. A successful injection then crosses directly from text to authority.

Diagnosis

For each workflow, draw a path from every input to every possible effect. Mark:

1. who controls the input and whether its origin is authenticated;
2. which private context can be combined with that input;
3. which tools are reachable and which credentials they use;
4. whether arguments are free-form or validated against a narrow schema;
5. where authorization is checked and whose authority it represents;
6. whether a human can see the exact effect before commitment;
7. how the system detects, contains, and reverses a wrong action.

If an untrusted document can influence a high-impact tool call without an independent authorization decision, the design depends on the model acting as a security boundary.

Solution

Separate the workflow into trust-aware stages. A reader extracts candidate facts from untrusted material without effectful tools. A planner proposes a typed action with evidence references. A policy component evaluates identity, tenant, resource, action, risk, and current state. A narrow executor performs only the authorized action and returns a receipt. A verifier checks the actual external state.

Minimize accessible context and credentials at each stage. Bind authorization to the user, tenant, resource, action, and time—not merely to the agent application. Treat retrieved instructions as data unless a trusted workflow definition explicitly promotes them.

Use prompts as one control: tell the model the trust labels, require it to cite the instruction source, and make it surface conflicts. Then test direct, indirect, encoded, multilingual, nested, and multi-step injections. Record not only whether the model refused, but whether sensitive data or an effect escaped.

Artifact

Use the Prompt-Injection Control Matrix during design and security review. Complete one row for every consequential action, not one row for the entire agent.

Common mistakes

• Adding “ignore malicious instructions” to the system prompt and closing the security issue.
• Giving a browsing or retrieval agent the same credentials as an effectful executor.
• Using one broad OAuth token for every user, tenant, resource, and action.
• Treating model refusal as the only security test outcome.
• Sending hidden private context to the model before it is needed.
• Asking for human confirmation without showing the exact resource, action, arguments, and consequences.