Direct input
An attacker supplies instructions in a message the agent accepts.
oktsec / Prompt Injection Protection
Prompt injection. Limit where it can lead.
An untrusted instruction can redirect an agent. Test those paths, inspect content and constrain the privileged actions that follow with explicit policy.
Attackers can hide instructions in ordinary content.
Prompt injection occurs when untrusted content attempts to change an AI system’s instructions or behavior. In an agent workflow, the consequential question is whether that redirection can trigger a tool call, disclose data or change a connected system.
Retrieved documents
A runbook, web page or search result includes instructions disguised as task data.
Tool responses
An MCP response asks the agent to obtain credentials or call another tool.
Agent handoffs
A message relays untrusted instructions to an agent with greater authority.
A poisoned runbook should not delete a production database.
An operations agent is asked to diagnose an outage. Retrieved documentation tells it to delete the database and recreate it as a recovery step. The critical boundary is the proposed destructive action.
The runbook says
“reset the database.”
Retrieved text attempts to replace the diagnostic task with a privileged operation.
Explicit action policy
The document cannot grant new authority.
The tool request
is rejected.
A configured deny rule stops database deletion at the supported enforcement point. The decision is recorded.
Illustrative scenario. The outcome depends on the configured rule and integration. Actions outside the enforcement path are outside this control.
Scan content and restrict tool access.
Content inspection
Deterministic scanning looks for injection, credential and other threat patterns in messages and supported tool interactions.
What does the content contain?Action authorization
Explicit policy checks identity, tools, parameters and configured destinations before the governed action runs.
Is this action within scope?Evidence and review
Record the verdict and findings. Route quarantined work to review according to configured policy.
What was decided, and why?Content scanning and action authorization address different failure modes. Neither is a universal guarantee against prompt injection.
Explore Control decisionsTest whether an injected instruction can trigger an action.
Assessment exercises permitted adversarial inputs and follows the attempted tool call. The finding explains the entry point, the authority it reached and the control needed to close the path.
- Choose the entry point
- Identify the external content the agent reads and how it enters the task.
- Trace the requested authority
- Observe the credentials, tools and parameters the redirected agent attempts to use.
- Check the outcome within scope
- Record whether the configured boundary stops the action, using agreed targets and stop conditions.
- Review the remediation
- Narrow the reachable authority, adjust the control and define any retesting in the scope.
A system prompt cannot grant or revoke a permission.
Prompts express the task and intended behavior. Permissions determine the systems an agent can affect. Treat server access, filesystem isolation, credentials and outbound network policy as part of the security design.
Keep authority outside the instruction.
A retrieved page should not broaden a tool allowlist. A tool response should not approve credential access. A peer agent’s message should not silently increase delegated scope.
Review MCP trust boundariesStart with a clear answer.
Can prompt injection be solved only with a better system prompt?
A system prompt helps express intended behavior, but untrusted content can still attempt to redirect the model. Privileged actions need controls outside the model’s instruction following.
Does Oktsec use an LLM to make the security decision?
No. The enforcement path uses deterministic checks and explicit policy. A model is not responsible for deciding whether the requested action is authorized.
How do we test our exposure?
Choose a workflow that reads untrusted content and can use tools. An Assessment scopes the permitted testing, follows the attempted action and records the evidence needed to reproduce a finding.
Research on injection and authorization.
Assess an agent that reads untrusted content.
Identify the documents, messages or tool responses the agent reads. We will test whether they can trigger actions outside its assigned task.