---
source: https://iinventedlight.com/library/notes/ao-security-prompt-injection-design.md
title: "Design agents so prompt injection cannot steer them"
license: CC-BY-4.0
license_url: https://creativecommons.org/licenses/by/4.0/
source_license: "CC BY 4.0; restated in our own words"
attribution: "Summary by iinventedlight (AI-assisted). Sources: arXiv, [2503.18813] Defeating Prompt Injections by Design, CC BY 4.0; arXiv, [2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections, CC BY 4.0."
author: "iinventedlight (synthesis of cited sources); text drafted with AI assistance"
date: 2026-11-04
status: published
checked_on: 2026-11-04
as_of: 2026-11-04
confidence: medium
untested: "No experiment was rerun; only the fetched arXiv abstract pages were read. Results are as reported by the authors."
category: agent-operations
topic_area: "agent operations: security"
tags: agents, security, prompt-injection, design-patterns
sources:
  - id: S1
    title: "[2503.18813] Defeating Prompt Injections by Design"
    publisher: arXiv
    url: https://arxiv.org/abs/2503.18813
    accessed: 2026-11-04
    license: "CC BY 4.0"
  - id: S2
    title: "[2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections"
    publisher: arXiv
    url: https://arxiv.org/abs/2506.08837
    accessed: 2026-11-04
    license: "CC BY 4.0"
---
# Design agents so prompt injection cannot steer them

## Short answer
Do not rely on the model to resist injected text. Build a system layer that fixes control flow from the trusted request, so untrusted data cannot change what the agent does. Add capability checks on tool calls to stop data leaks. [S1][S2]

## Evidence
CaMeL solved 77% of AgentDojo tasks with provable security, compared with 84% undefended. [S1] Design patterns trade some utility for provable resistance. [S2]

## Claims
- id: C1
  claim: LLM agents are vulnerable to prompt injection.
  source: S1
  evidence: "LLM agents are vulnerable to prompt injection attacks when handling untrusted data"
- id: C2
  claim: Untrusted data never impacts program flow.
  source: S1
  evidence: "the untrusted data retrieved by the LLM can never impact the program flow"
- id: C3
  claim: Capabilities prevent exfiltration.
  source: S1
  evidence: "uses a notion of a capability to prevent the exfiltration of private data"
- id: C4
  claim: Design patterns give provable resistance.
  source: S2
  evidence: "design patterns for building AI agents with provable resistance to prompt injection"

## Sources
- [S1] [2503.18813] Defeating Prompt Injections by Design. arXiv. https://arxiv.org/abs/2503.18813 . License: CC BY 4.0. Accessed 2026-11-04.
- [S2] [2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections. arXiv. https://arxiv.org/abs/2506.08837 . License: CC BY 4.0. Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).