The moment an AI system gained tools, its security model changed species. A chatbot that gets manipulated says something wrong; an agent that gets manipulated does something wrong — with your credentials. Prompt injection remains unsolved at the model layer, so production security is an operations discipline: assume injection will land, and bound what it can reach. Here's the working playbook.
The Threat Model in Three Sentences
Any text an agent reads is potentially instructions: web pages, emails, documents, tool outputs, even file names. An attacker who can place text where your agent will read it can attempt to redirect the agent's actions. Defense therefore cannot rely on the model "being careful" — it must make the worst plausible action survivable.
Layer 1: Action-Level Screening
The industry's bar moved in 2026 from filtering inputs/outputs to screening every agent action. Amazon's integration of Bedrock Guardrails into AgentCore is the reference pattern: each tool call is evaluated for prompt-injection indicators, harmful content, and sensitive-data exposure before execution. If your stack lacks a native equivalent, insert a policy gate between the model's tool-call request and its execution — that interception point is the single most valuable piece of security infrastructure you can build.
Layer 2: Least-Privilege Tooling
Scoped credentials per agent, per connector — never a shared service account. Mistral's admin surface (connector access managed by workspace/org, scoped API keys) shows the emerging standard; demand the same from every vendor.
Read/write separation — agents that research shouldn't hold write credentials; agents that act should hold the narrowest write scope that completes the task.
Allowlists over denylists for tools, domains, and recipients. An agent that can email anyone will eventually email the wrong one.
Layer 3: Blast-Radius Design
Sandboxed execution for anything that runs code or browses — isolated environments (the CoreWeave Sandboxes category) are now rentable infrastructure; there's no excuse for agents executing in production contexts.
Irreversibility gates — human approval on actions that can't be undone (payments, deletions, external sends), automation for everything reversible.
Kill switch per use case — a way to disable the agent path and fall back to the human process in minutes, tested like a fire drill.
Layer 4: Detection
Injection that lands looks like an agent behaving plausibly but oddly. Detect it with: anomaly monitoring on tool-call patterns (new recipients, unusual data volumes, off-policy domains), sampled human review of action traces weighted toward high-privilege calls, and canary tokens in stores an agent should never read — an access is a high-signal alarm.
Layer 5: Procurement Questions
Ask every agent-platform vendor: Is screening applied per-action or per-conversation? Can connectors be allowlisted at org level? Are action traces exportable to our SIEM? What is your model's measured injection-success rate on public benchmarks, and how does it change with our tool schema? Vendors who answer crisply have done the work.
The Uncomfortable Truth
No current stack makes prompt injection impossible; the goal is making it unprofitable — small blast radius, fast detection, cheap recovery. Teams that internalize this ship agents safely; teams waiting for a model-layer fix either ship nothing or ship incidents.
