Read path
Identify every source the model can ingest before it decides on an action.
Operational security journal Deep guide June 6, 2026
Defense guide
How to defend autonomous agents against prompt injection in the real world
The hard part is not spotting bad prompts in a lab. The hard part is building a system where untrusted text can be read without automatically becoming a permitted action.
AI Agent Security
The attack surface begins wherever the agent reads text
Any place the agent can read untrusted text is a possible steering surface. That includes emails, tickets, documents, web pages, internal chat, and even outputs from other tools.
Decision path
Figure out which inputs can affect a later tool call.
Sensitive content
Mark data that should never be used as a justification for action without extra checks.
External content
Content from outside the trusted boundary should be treated as adversarial until proven otherwise.
AI Agent Security
Good defense is layered and boring
The strongest defense is not a single prompt tweak. It is a stack of controls that make it harder for one bad instruction to become a bad action.
Content isolation
Keep untrusted text separate from execution policy and system instructions.
Tool narrowing
Limit which tools exist in the first place.
Policy checks
Decide at runtime whether the action is allowed.
Monitoring
Track denied and allowed actions so you can see the failure modes that keep repeating.
AI Agent Security
Validation should prove the defense actually works
A defense is only real if it holds under test. That means adversarial inputs, repeated attempts, and situations where the model is confident but wrong.
Test whether the agent can be nudged into changing a tool call, changing a destination, or leaking data it should have left alone.
Repeat the test after every material change to the tool set, because a new tool often opens a path that did not exist before.
Next step
Use governance to keep autonomous systems useful
VEX Protocol helps make the action boundary explicit so the model can suggest without automatically being allowed to execute.
Sources
References and further reading
OWASP GenAI Security
The main public risk framing for prompt injection.
NIST AI RMF
Useful governance framing for risk reduction.
Anthropic MCP overview
Helpful context for tool-connected agents.