LLM security creates a two-way trust boundary: untrusted content enters the model and generated content returns to software and users. Prompt injection exploits this boundary through user input, documents, websites, emails or tool results.

No system prompt can solve this problem alone. A secure AI application combines instruction and data separation, least-privilege tools, independent authorization, context minimization, output validation, approval and adversarial testing.

What you will learn

  • Treat retrieved pages, files, emails and tool results as untrusted data.
  • A model must never authorize its own access or tool calls.
  • Minimize sensitive context because a model cannot expose data it never receives.
  • Validate model output before using it as SQL, HTML, code, a URL or an external action.

Direct and indirect prompt injection

Direct prompt injection asks the model to ignore policy or reveal hidden information. Indirect injection is embedded in retrieved content, such as a webpage instructing an AI agent to upload private files.

The model processes both as tokens, so a warning in the system prompt is helpful but not a security boundary. The application must restrict what context influences actions and what actions are possible.

Separate instructions, data and authority

Mark content origin and trust level through the pipeline. Retrieved documents should be quoted or structured as data, not merged into privileged instructions. Summaries must preserve provenance.

Authentication establishes identity and authorization decides permission. Enforce both in deterministic services for every resource and operation. Never accept a model claim that the user approved an action.

Least-privilege AI tools

Give agents task-specific tools with narrow schemas. Use allowlisted destinations, bounded amounts, tenant-scoped identifiers and server-side ownership checks. Separate read from write capability.

Require preview and human confirmation for financial, destructive, privileged or public actions. Use idempotency, timeouts and rate limits to contain retries or loops.

Sensitive data protection

Classify data before connecting it to an LLM. Retrieve only the records and fields needed. Redact secrets and personal data, isolate tenants and enforce retention and deletion for prompts, traces and feedback.

Understand model-provider handling, region and training settings before sending confidential content. Keep credentials outside prompts and rotate any secret exposed to model context.

Treat model output as untrusted

Generated HTML can contain injection, generated URLs can target internal systems, and generated commands can be destructive. Apply context-aware encoding, strict schemas and allowlists.

Do not execute generated code in the application environment. When execution is required, use a disposable sandbox with no ambient credentials, restricted network, quotas and audit evidence.

Security testing and detection

Test instruction override, hidden document text, data exfiltration, cross-tenant access, excessive tool use and insecure output. Exercise complete workflows, not only chat responses.

Log sanitized content sources, authorization decisions, tools and approvals. Alert on unusual tool sequences, repeated denials, sensitive-data patterns and unexpected destinations.

Production checklist

  • Label and isolate untrusted external content.
  • Authorize every tool operation outside the model.
  • Minimize context and prevent cross-tenant retrieval.
  • Validate and encode model output before downstream use.
  • Sandbox code execution without ambient credentials.
  • Continuously test injection, exfiltration and excessive agency.

Frequently asked questions

Can a system prompt prevent prompt injection?

No. It guides behavior, but capability and authorization must be enforced outside the model.

Is RAG automatically secure?

No. RAG introduces poisoned content, permission filtering and indirect prompt-injection risks that need controls.

Should every LLM trace be stored?

No. Keep the minimum operational evidence needed and redact sensitive context. Retention should follow purpose and data policy.

Continue exploring AI and technology

Authoritative references