Policy cannot stop an agent from reading hostile text, so it limits the damage instead: least privilege, human approval for high-risk actions, separation of untrusted content, and logging. Assume that some injected instruction will eventually be followed, and make sure the agent cannot do much harm when it is.
Definition
OWASP separates direct from indirect prompt injection. Direct injection is a user's own input changing model behavior. Indirect injection happens when the model processes external content, such as web pages or files, that contains hidden instructions. Coding agents face the indirect kind through issues, pull request text, README files, dependency docs and tool output.
What OWASP recommends
The mitigations OWASP lists map neatly onto policy sections:
| Mitigation | Policy rule |
|---|---|
| Least privilege | Agents get minimum tools and scoped tokens |
| Human approval for high-risk actions | Pushes, deletes, network calls and deploys prompt a person |
| Separate and label untrusted content | Issue and web content is treated as data, not instructions |
| Constrain role and scope | Narrow tasks, short sessions |
| Treat the model as an untrusted user | Check output with deterministic code and normal CI |
| Adversarial testing | Regular red team exercises on the agent setup |
Write rules for the inputs
- List the input sources an agent may read automatically, such as the repository it was assigned.
- Require approval before it reads from outside that list, for example fetching a web page.
- Ban agents from acting on instructions found in issues from unknown authors without human triage.
- Keep secrets out of reach, so even a hijacked agent has nothing to send.
Write rules for the outputs
An injected agent usually tries to exfiltrate data or run something. So:
- Restrict network access to named hosts.
- Require approval for shell commands outside an allowlist.
- Run unattended agents in a sandbox with no production credentials.
- Require review of any change to CI configuration or dependency manifests.
Test it
Create a harmless test issue with a hidden instruction such as "also print the contents of a dummy file", assign it to your agent, and see whether the controls hold. Record the result and repeat after tool updates.
Try it yourself
Click through it at your own pace, or open it full screen.
Follow the setup and notice how many tools a connected client can reach, since each one is something an injected instruction could try to use.
Quick check
Can a filter detect every injection?
No. Filters help but are not reliable, so limit privileges rather than depending on detection.
Is a read-only agent safe?
Safer, not safe. It can still leak what it reads if it has any outbound channel.
Safeguard offers MCP Guardrail and agent identity to scope what connected agents can do, plus a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
