Counter prompt injection through tool outputs
An email, a web page or a ticket read by an agent can carry hidden instructions that hijack its behavior. This lesson teaches you to spot where outside content reaches your agent and to require protections built into the architecture, instead of relying on the wording of the prompt alone.
Lesson objective
By the end of this lesson, you will be able to spot the paths through which third-party content enters an agent's context via its tools, and specify for each one structural mitigations that do not rely on the prompt alone.
Topics covered
- prompt injection
- indirect prompt injection
- AI agent security
- tool outputs
- LLM security
In the glossary
Where it fits
Human control and security
Where must a human approve, with which rights does the agent act, and how do you stop it from obeying booby-trapped content?
Lessons in this module
- Place human approvals according to blast radius
- Counter prompt injection through tool outputs (this lesson)
What you will learn in this module
This lesson is part of the course Design reliable agents and tool calling
- Place human approval points and an agent's permissions according to the blast radius of each action.
- Identify prompt-injection paths through tool outputs and specify structural mitigations that do not rely on the prompt alone.
Related courses
- AI & ProductAdvancedRegular practice: you already use the tools or work on this topic.
Build an AI assistant for your product
3 hr
- AI & ProductAdvancedRegular practice: you already use the tools or work on this topic.
Design a RAG architecture that fits your product
3 hr 30 min
- AI & ProductAdvancedRegular practice: you already use the tools or work on this topic.
Evaluate an AI feature: test sets, metrics and LLM judges
3 hr