AI cybersecurity manual: prompt injection and secure tool access
Threat-model enterprise assistants and prevent untrusted content from becoming privileged instructions.
Prepared on 20 Oct 2026 for editorial review. Product specifications and company research results are not asserted unless verified.
Map the trust boundaries
List where user input, uploads, search results and tool responses enter the system. Identify the tools, records and credentials that could be exposed if the model follows malicious instructions. Prioritise impacts rather than judging whether a prompt looks suspicious.
Enforce controls outside the model
Keep private credentials out of the model context. Authenticate tool callers, validate arguments and apply least-privilege access to records and destinations. A system prompt asking the model to behave safely is not an access-control mechanism.
Sanitise generated output before passing it to another interpreter or system. Use constrained schemas and approved operations, and require independent approval for high-impact actions.
Run authorised security tests
In a non-production environment, test injected instructions inside uploaded files and retrieved passages. Verify that restricted records cannot be retrieved or exported and that tools reject attempts to exceed the caller’s permissions.
Record the exact setup, observed impact and remediation owner. Re-run the same cases after fixes and retain audit logs without unnecessary personal data or secrets.
Prepare response and recovery
Define who can suspend an agent, disable a connector and revoke credentials. Preserve incident evidence under an agreed retention policy, review affected actions and restore only after the root cause and permission boundary are understood.