Prompt injection cannot be fully prevented, so developers limit what an injected instruction can do. Give the model the least privilege it needs, require human approval for high-risk actions, separate and label untrusted content, validate outputs with code, and test with adversarial inputs. Never let one agent hold private data, untrusted input and an outbound channel together.
Key takeaways
- OWASP says prompt injection may have no foolproof prevention, so mitigations aim to reduce impact.
- Indirect injection arrives through content the model reads, such as web pages, issues and files.
- The lethal trifecta: private data, untrusted content, external communication. Remove one.
- Approvals and sandboxes matter more than clever prompt wording.
What is prompt injection?
Prompt injection is when input changes a model's behaviour in unintended ways. OWASP's LLM01 entry splits it into two types. Direct injection comes from the user's own input. Indirect injection comes from external content the model processes, such as a web page or file that contains instructions.
For developers using coding agents, indirect injection is the bigger concern. The agent reads an issue, a README or a tool result, and that text can carry instructions.
What does OWASP recommend?
OWASP lists seven strategies for LLM01:
- Constrain model behaviour with a clear role and boundaries.
- Define and validate expected output formats with deterministic code.
- Implement input and output filtering.
- Enforce privilege control and least privilege access, with the application using its own API tokens and keeping functions in code instead of exposing them to the model.
- Require human approval for high-risk actions.
- Segregate and identify external content.
- Run adversarial testing and attack simulations, treating the model as an untrusted user.
What is the lethal trifecta?
It is Simon Willison's name for three capabilities that are dangerous together: access to your private data, exposure to untrusted content, and the ability to communicate externally. With all three, an attacker can trick the agent into fetching private data and sending it out. His advice for users is to avoid the combination entirely. Guardrail products, he notes, cannot guarantee protection.
How do you apply this when building an LLM feature?
Treat model output like input from an untrusted user. Check it in code before it reaches a database, a shell or another service. Keep API tokens in your application, not in prompts. Scope each tool to one job. If an agent has read access to private data and reads untrusted text, remove its ability to send data out.
How do you apply this when using a coding agent?
Use the controls your tool provides and keep them on. Claude Code's documentation lists these practices for untrusted content: review commands before approval, avoid piping untrusted content to the agent, verify changes to critical files, and use virtual machines for scripts and tool calls. Its sandbox adds network isolation with an allowed domain list that starts empty. Cursor's documentation says terminal commands and MCP tool calls need approval by default, and calls its Run Modes best-effort guardrails, not a hard boundary.
Vet MCP servers too, since tool output is an injection channel. See how to vet an MCP server before installing.
Checklist
- Model has only the tools this task needs
- Output validated in code before it acts
- Approval required for writes, deletes and network calls
- Untrusted content labelled and kept apart
- No agent holds all three trifecta capabilities
- Adversarial tests in your test suite
Frequently asked questions
Can a system prompt stop prompt injection?
It helps constrain behaviour, but OWASP says no foolproof prevention exists, so rely on privilege limits and approvals too.
What is the difference between direct and indirect injection?
Direct comes from the user's input. Indirect comes from external content the model reads, like web pages or files.
Do guardrail products solve it?
Willison notes they cannot guarantee protection. Use them as one layer, not a replacement for limiting privileges.
What is the cheapest fix today?
Keep approvals on and cut the outbound channel from any agent that reads untrusted text.
Sources
- OWASP LLM01 Prompt Injection: https://genai.owasp.org/llmrisk/llm01-prompt-injection/
- The lethal trifecta, Simon Willison: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
- Claude Code security documentation: https://code.claude.com/docs/en/security
- Claude Code sandboxing documentation: https://code.claude.com/docs/en/sandboxing
- Cursor agent security documentation: https://cursor.com/docs/agent/security
Last reviewed: 19 October 2026.
