Prompt injection means input that changes what a language model does, and for a coding agent that input can sit in a README, an issue, a code comment or a web page it reads. The defense is to limit what the agent can do, since no reliable way to stop the injection itself is known.
The two forms
OWASP's entry on prompt injection separates two kinds.
- Direct: a user's own prompt alters the model's behavior, on purpose or by accident.
- Indirect: the model takes in external content, such as web pages or files, and that content contains instructions that change its behavior.
Coding agents live in the indirect case. They read repositories, dependency docs, tickets and search results, all of which other people can write.
What it looks like in practice
Imagine an agent asked to fix a failing test. It opens an issue thread for context. One comment contains text telling the agent to run a command or send a file somewhere. The agent cannot reliably tell your instruction from the commenter's.
OWASP lists possible impacts including disclosure of sensitive information, unauthorized use of functions the model can reach, and arbitrary commands in connected systems.
What OWASP recommends
The page lists these mitigations and states that no foolproof prevention is known, so they reduce impact:
- Constrain model behavior through system prompts.
- Validate expected output formats with deterministic code.
- Apply input and output filtering.
- Enforce least privilege and handle tool calls in application code.
- Require human approval for high risk actions.
- Separate and label untrusted external content.
- Run regular adversarial testing and treat the model as an untrusted user.
Translating that for your team
- Least privilege: read only access to the repository where possible, no deployment credentials, no production data.
- Approval gates: require a human yes for installs, network calls to new hosts, file deletion and anything that pushes code.
- Egress control: an agent that cannot reach arbitrary hosts cannot easily send your files out.
- Treat fetched content as hostile. If an agent browses, assume the page was written by someone who wants your keys.
- Test it. Put a harmless injection string in a test issue and see what your setup does.
See also least privilege permissions for AI coding agents.
Safeguard's MCP Guardrail and agent identity features are aimed at controlling what agents can call and as whom.
A quick test you can run
Create a test issue in a sandbox repository containing a harmless instruction, such as asking the agent to print a specific phrase. Ask the agent to summarize the issue. If it follows the embedded instruction, you have learned that content from tickets reaches its decision making, and you can decide which permissions to remove. Repeat after changing tools or settings.
Quick check
Can a better system prompt solve this?
It helps but does not solve it. OWASP states that no foolproof prevention is known, so the permissions you grant matter more than the wording you use.
Sources
Last reviewed: 19 October 2026.
