Prompt injection and jailbreaks get the headlines, and input filtering helps. But no filter catches everything, so the useful question is: when a bad instruction gets through, what is the agent still unable to do?
Layer the controls
- Before the model: validate inputs, strip or isolate untrusted content (emails, web pages, uploaded files) from instructions.
- At the tool boundary: an allow-list of tools, typed parameters, and server-side checks on every call. The model asks; the tool decides.
- At the identity layer: short-lived credentials scoped per task, so a hijacked session can't reach beyond its job.
- At runtime: endpoint and cloud security tooling that can see agent processes and their actions, and contain them.
- After the fact: complete traces, so an incident can be reconstructed and the gap fixed.
Treat untrusted content as data, never as instructions
Most agent exploits work because content the agent reads is treated as something it should obey. Keep retrieved documents, emails and web content in a clearly separated part of the context, and never let them change which tools the agent may call.
Use the security stack you already run
Agent activity should land in the same place as everything else your security team watches. Endpoint and cloud security platforms are adding agent-specific visibility; connecting agents to them is usually more valuable than adding a separate AI security tool nobody monitors.