Prompt injection defense — treat retrieved content as untrusted
Greshake et al. 2023 — indirect prompt injection
1. attacker controls retrievable content (web page, PDF, email, memory note)
2. agent ingests attacker instructions override developer prompt
3. demonstrated exploits: data theft, worming, memory poisoning, ecosystem contamination
claim: processing retrieved prompts = arbitrary code execution on the tool-use surface
PVE pattern Prompt, Validator, Executor
1. main model proposes tool call
2. cheap fast validator inspects arguments
3. validator inspects retrieved content sources
4. reject on injection marker or unsafe destination
5. pass executor runs; tell main model on reject
cost: one extra inference per tool call
six-control defense doctrine (2026)
1. all retrieved content untrusted
2. allowlist / blocklist navigation
3. per-step safety evaluation (Gemini 2.5)
4. guardrails on tool inputs + outputs
5. human-in-the-loop on sensitive actions
6. external content capture + span references
"only direct instructions from the user count as permission" — OpenAI CUA docs