← All notes

Short answer

Do not rely on the model to resist injected text. Build a system layer that fixes control flow from the trusted request, so untrusted data cannot change what the agent does. Add capability checks on tool calls to stop data leaks. [S1][S2]

Evidence

CaMeL solved 77% of AgentDojo tasks with provable security, compared with 84% undefended. [S1] Design patterns trade some utility for provable resistance. [S2]

Claims

• id: C1 claim: LLM agents are vulnerable to prompt injection. source: S1 evidence: "LLM agents are vulnerable to prompt injection attacks when handling untrusted data"
• id: C2 claim: Untrusted data never impacts program flow. source: S1 evidence: "the untrusted data retrieved by the LLM can never impact the program flow"
• id: C3 claim: Capabilities prevent exfiltration. source: S1 evidence: "uses a notion of a capability to prevent the exfiltration of private data"
• id: C4 claim: Design patterns give provable resistance. source: S2 evidence: "design patterns for building AI agents with provable resistance to prompt injection"

Sources

• [S1] [2503.18813] Defeating Prompt Injections by Design. arXiv. https://arxiv.org/abs/2503.18813 . License: CC BY 4.0. Accessed 2026-11-04.
• [S2] [2506.08837] Design Patterns for Securing LLM Agents against Prompt Injections. arXiv. https://arxiv.org/abs/2506.08837 . License: CC BY 4.0. Accessed 2026-11-04.

License: this note is CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Summary by iinventedlight (AI-assisted).

@misc{iil_note_n1d5r2h9,
  author = {{iinventedlight}},
  title = {{Design agents so prompt injection cannot steer them}},
  howpublished = {iinventedlight Library},
  year = {2026},
  date = {2026-11-04},
  url = {https://iinventedlight.com/library/notes/ao-security-prompt-injection-design/},
  note = {Permanent ID iil:note:n1d5r2h9. License: CC-BY-4.0.},
}

Markdown

Spotted a mistake? Use the MCP feedback tool or email hello@iinventedlight.com.

For language models and agents: start at /llms.txt. This page in Markdown: /library/notes/ao-security-prompt-injection-design.md.