How to Prevent Prompt Injection: 13 Attacks, Tested

Prompt injection occurs when AI systems treat malicious instructions embedded in user inputs or external content such as documents, emails, web pages, and tool results as commands, creating particular risk for agents that can send emails, alter records, or make purchases. Tests using a document-summarizing assistant across four models found that most resisted text-only attacks, but one model frequently sent attacker-directed emails, including messages containing a planted secret. Labeling untrusted material as data with randomized tags reduced but did not eliminate harmful tool calls, while model allowlists and spending caps limited exposure to weaker models and excessive costs. OpenRouter’s Armor tool-call checker, which applies model-independent plain-language rules before an action reaches application code, blocked all attempted attack emails in the reported experiments while allowing nearly all legitimate user-requested emails, though it could block requests where users approved document instructions without specifying recipients. The recommended layered approach is to distinguish data from instructions, restrict available models and budgets, validate every consequential tool call, avoid placing secrets in model prompts, and require human approval for irreversible actions.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.