A GitHub issue or pull request comment
Your agent was asked to triage it.
Use case · prompt injection
Stop trying to win the argument with the model.
Prompt injection is not going to be solved at the prompt layer. It is a property of how language models process text, and every defence that lives inside the model is enforced by the component the attack subverts. The durable move is to make a successful injection worthless.
The reframe
An injected instruction is only a security incident if it can become an operation against something valuable.
That sentence is the whole strategy. You cannot reliably stop the model from being persuaded. You can absolutely stop the persuaded model from reading a private key, because reading a private key is a filesystem operation, and filesystem operations are governed by policy that does not read English and cannot be talked around.
Indirect injection
Everything your agent reads is an input channel.
Direct injection — a user typing something adversarial — is the boring case. The dangerous form arrives inside content the agent was legitimately asked to process, from a party who was never in the conversation.
A dependency README or changelog
Read during an upgrade, in full, without suspicion.
A web page the agent fetched
Including one it found rather than one you chose.
An MCP tool result
Returned by a server, injected straight into context.
A code comment or commit message
In a repository you did not write.
A file the agent was asked to summarise
A PDF, a log, a customer email.
This is the confused deputy problem with a language model in the deputy's chair: a trusted, authorised actor persuaded to use its authority on someone else's behalf.
The defences, ranked honestly
Three of these reduce the rate. One changes the outcome.
Use all four. But be clear about which ones are probabilistic and which one holds when the others fail — because the ones that reduce the rate all share a dependency on the model behaving.
Prompt hardening
Instructions telling the model to ignore instructions found in content.
ProbabilisticHelps at the margin. It is a request made in the same channel as the attack, to a system with no reliable way to distinguish the two.
Input filtering / classifiers
Detect and strip injection attempts before they reach the model.
ProbabilisticCatches known shapes. Attackers write new shapes; this is the signature-antivirus arms race with a worse detection surface.
Human in the loop
Confirm each sensitive action.
ProbabilisticGenuinely effective, and genuinely defeated by volume. Approve two hundred prompts and you are approving reflexively by the fiftieth.
Capability containment
The injected instruction can be followed, and still cannot reach anything it was not granted.
StructuralDoes not prevent the injection and does not claim to. It removes the payoff, which is the part you can actually control.
The combination that costs you
Private data, untrusted content, and a way out.
An agent needs all three legs for an injection to become a loss. Containment does not remove the middle one — you cannot stop an agent reading the issues it was asked to triage — but it takes direct aim at the other two.
Access to private data
Keys, tokens, browser profiles, unrelated repositories, mounted shares.
Narrowed. One granted workspace, resolved to real objects. Everything else denied because nothing granted it.
Exposure to untrusted content
Issues, READMEs, web pages, tool results — the material the agent exists to work on.
Unchanged. This is the job. Removing it would remove the agent.
A way to communicate outward
An HTTP request, a commit, a webhook, a DNS lookup carrying data in the name.
Explicit. Destinations are separate authority, classified from their bytes. Reaching one endpoint grants nothing about any other.
Afterwards
A record the agent did not write.
If your only account of a session comes from the agent's own transcript, you are reading the defendant's version of events — and a successfully injected agent has every reason to summarise helpfully.
Every decision lands in a local, append-only, hash-chained store: the requesting subject, its process lineage, the operation, the resource, the verdict. An agent that suddenly reaches for ~/.ssh in the middle of a refactor is a legible event, written by the boundary rather than by the thing that tripped it.
FAQ
Prompt injection, answered
What is prompt injection?
Prompt injection is when text a language model reads as data is treated by the model as instructions. In the indirect form — the one that matters for agents — the text arrives from content the agent processes: an issue, a README, a web page, a tool result. The model has no reliable mechanism for separating "content I was asked to look at" from "instructions I was given", because to a language model both are just tokens in the same context.
Can prompt injection be prevented?
Not reliably, and treat any claim otherwise with suspicion. It is a structural property of how language models process text, not a bug awaiting a patch. Prompt hardening, classifiers and confirmation dialogs all reduce the rate. None of them closes the class, and defences that depend on the model behaving correctly are defeated by the thing that makes the model misbehave.
If you cannot prevent it, what do you do about it?
Separate the attack from the consequence. An injected instruction only matters if it can become an action against something valuable. If the agent’s filesystem, network, execution and capability authority is deny-by-default and scoped to what the task needs, then a successful injection produces an attempt that is denied and recorded. The attacker wins the argument with the model and gets nothing for it.
Does BitShout detect prompt injection?
No, and it deliberately does not try. Detecting injection would mean interpreting natural language to guess intent, which is exactly the unreliable step BitShout is designed to be independent of. BitShout does not care why an agent is asking; it evaluates the operation against policy using observed facts. An agent that has been injected and an agent that is confused produce identical, correctly-handled requests.
What is the “lethal trifecta” and how does containment address it?
The phrase describes the combination that makes agent exploitation worthwhile: access to private data, exposure to untrusted content, and a way to communicate outward. Any two are usually survivable; all three together mean an injected instruction can read something valuable and send it somewhere. Containment attacks two legs directly — it narrows what private data is reachable, and it makes outbound destinations explicit authority rather than an ambient capability.
How would I know an injection attempt happened?
The denial is recorded. BitShout writes every decision to a local, append-only, hash-chained evidence store with the requesting subject, its process lineage, the operation, the resource and the verdict. An agent suddenly attempting to read ~/.ssh mid-task is a legible event in that record, and unlike the agent’s own transcript, it is not written by the party under suspicion.