Prompt Injection Defense

Protect your agent from acting on malicious instructions embedded in external content.

Defense Layers

Layer 1: Content Tagging

Wrap all untrusted content in markers before the agent processes it:

CODEBLOCK0

Sources: web_search, gmail, calendar, file_download, pdf, rss, api_response.

Layer 2: Content Scanning

Scan text for injection patterns, scoring severity (none/low/medium/high):

CODEBLOCK1

Detects: override attempts, role reassignment, fake system messages, data exfiltration, authority laundering, tool directives, secret patterns, Unicode tricks, suspicious base64.

Exit code 1 = high severity. Use in pipelines.

Layer 3: Memory Write Guardrail

Never write external content directly to memory. Use the safe write pipeline:

CODEBLOCK2

• - Scans content with INLINECODE7
• If severity >= medium: quarantines to INLINECODE8
• If clean: appends to target memory file with source attribution
• Targets: daily (memory/YYYY-MM-DD.md) or longterm (MEMORY.md)

Layer 4: Agent Rules

Add to SOUL.md or AGENTS.md:

CODEBLOCK3

Layer 5: Canary Detection

See references/canary-patterns.md for the full pattern list including Unicode tricks and response protocol.

Hardening Checklist

1. 1. ☐ SOUL.md has prompt injection defense rules
2. ☐ All external tools wrap output in <untrusted_content> tags
3. ☐ Memory writes go through INLINECODE13
4. ☐ Email/API access is read-only where possible
5. ☐ Agent cannot send messages without explicit user approval
6. ☐ Canary patterns documented, agent knows to flag them
7. ☐ Quarantine directory reviewed periodically

Limitations

• - No true data/code separation exists in LLMs
• Sophisticated attacks may bypass pattern detection
• Defense-in-depth is the only real strategy
• Permission restrictions (read-only APIs) are more reliable than prompt-level defenses