Prompt injection and agent risk

Prompt injection is not just a chat problem

Prompt injection happens when untrusted content includes instructions that conflict with the developer or user goal. In a simple chat, this may produce a bad answer. In an agent with tools, it can cause data exposure, wrong actions, bad purchases, file damage, or credential misuse.

Anthropic docs for computer use warn that Claude may follow commands found in webpages or images even when those commands conflict with your instructions. That is the key design fact: the model can misclassify hostile content as relevant instruction.

Controls that actually help

The safest agent designs do not ask Claude to remember that external content is untrusted. They structure the environment so untrusted content has fewer ways to cause damage. That means scoped tools, explicit approval flows, narrow file access, and logs that show exactly what Claude saw and did.

• Least privilege: expose only the tools, files, accounts, and scopes needed for the task.
• Human gates: require confirmation before irreversible, paid, external, or sensitive actions.
• Data isolation: keep secrets, credentials, private documents, and unrelated tabs out of the context.
• Output validation: check tool calls and final artifacts against a policy or schema.
• Source labeling: separate user instructions, system instructions, retrieved content, and tool output.

Red flags in agent prompts

Be suspicious of any workflow that gives Claude login credentials, opens arbitrary pages, lets external pages decide the next action, or mixes private data with web content. Also be suspicious of prompts that ask Claude to ignore previous instructions, reveal hidden prompts, exfiltrate files, or continue without user confirmation.

A reliable agent is less glamorous than a fully autonomous one. It has boring permissions, clear boundaries, and friction at exactly the points where mistakes would matter.