Treat outside text as untrusted input
Instructions hidden in a web page, file or message get less power over an AI agent. No method blocks them all, so this limits the damage.
Where to start
Our reading of the guidance below, for a small team. A starting point, not a complete program.
- Keep fetched pages, files and messages apart from the instructions an agent follows, and mark them as untrusted.
- Give an agent that reads outside content no tools that can send, delete, pay or publish.
- Before release, test agents against content that carries planted instructions.
The guidance
OWASP · LLM01:2025 Prompt Injection
Separate and clearly denote untrusted content to limit its influence on user prompts.
OWASP · LLM Prompt Injection Prevention Cheat Sheet
Keep trusted instructions separate from untrusted data, but do not treat text labels or prompt wording as an enforcement boundary.
Short quotes from the official guidance, linked. Read the source before you act on it.
Incidents from the Drops
No Drop has tagged an incident with this control yet.