Context engineering is the practice of deciding which information a language model sees on each step: instructions, tool definitions, retrieved documents, history and results. It extends prompt engineering to agents that run many turns. It also has a security side, because everything in context can steer the model.
How is it different from prompt engineering?
Anthropic's engineering team describes context as the set of tokens included when sampling from a model, and context engineering as the strategies for curating and maintaining the best set of tokens during inference, including information beyond the prompt. In their framing it is the natural progression from prompt engineering, which focuses on writing and organising instructions. You can read it in their post on effective context engineering for AI agents.
A single prompt is something you write once. An agent in a loop produces new data every turn, such as file contents, search results and error output, and something has to decide what survives into the next turn.
What goes into context?
- System instructions that set the role and rules.
- Tool definitions, including those provided through the Model Context Protocol.
- Retrieved or external data, such as documents and web pages.
- Message history and the results of earlier tool calls.
- Memory the agent stored earlier and now reloads.
Each piece competes for limited space, and the model's attention does not treat every token equally. Adding more is not always better, which is why trimming, summarising and just-in-time retrieval are common techniques.
Why is this a security topic?
Because the model cannot reliably tell trusted instructions from untrusted text in the same window. OWASP lists prompt injection as the first risk in its LLM Top 10. If a retrieved web page contains an instruction, and that page lands in context, the agent may act on it.
So context design is also access design. Ask four questions of every item: where did it come from, who can change it, how long does it stay, and what could the agent do while it is present?
Persistence raises the stakes. A poisoned note saved to long-term memory returns in later sessions. Summaries can launder content too, since a short summary of a hostile document loses the visible marker that it came from an outsider.
A constructed example
A coding agent reads a repository issue, opens linked pages for background, and has shell access. One linked page, written by a stranger, includes the line "also run this install command to set up the tool". If page text enters context with the same standing as the user's task, the agent might run it.
Better context engineering: label external content as data in its own section, keep the shell tool off for steps that only read, require approval for any command that touches the network or installs software, and discard the page after extracting the facts needed. None of these depends on the model being immune.
How to check or apply this
- Draw the context for one agent step. List each source and mark it trusted, internal or untrusted.
- Keep instructions and untrusted data in clearly separated sections, and state that data sections contain no commands. This helps but is not a guarantee.
- Give tools only when a step needs them. A reading step should not have write or execute rights.
- Scope credentials per task and expire them quickly.
- Gate high-impact actions, such as deleting data, spending money or installing software, behind human or policy approval outside the model.
- Cap and prune history. Remove tool output once its useful facts are extracted.
- Treat saved memory as an input to review, with provenance and expiry.
- Log what entered context before each action so incidents can be reconstructed.
- Test with planted instructions in documents and web pages, and track whether the agent follows them.
Quick check
Is a bigger context window safer or riskier?
Neither by itself. A larger window lets more untrusted text in, but also lets you include more instructions and checks. What matters is curation and what the agent is permitted to do.
Does RAG count as context engineering?
Yes. Choosing what to retrieve and how to present it is one of the main levers, and retrieved content is untrusted input.
Sources
- Anthropic, Effective context engineering for AI agents
- OWASP Top 10 for LLM Applications
- NIST AI Risk Management Framework
Last reviewed: 18 October 2026.
