prompt injection

Jailbreaking is the adversarial sport of steering a model around its own safety training. What matters is naming the technique families and treating defense as a layered, never-finished arms race, not a one-time patch.

Any content an agent reads can smuggle in instructions that hijack it. The signal is knowing why filtering can't fully solve injection and which containment controls actually bound the damage when it succeeds.

Writing the regexes takes ten minutes. The half of the question that separates candidates is the evaluation: a detector that blocks 'ignore the noise in the data' has shipped a bug to every analyst using your product. Here is the layered detector and the harness that proves it works.

There is no one-shot patch for prompt injection, and answering 'sanitize the input' loses the round. What lands is defense in depth: privilege boundaries, handling retrieved content as data rather than instructions, and a human gate on irreversible actions. Here is the layered answer.

When an agent holds private data, reads untrusted text, and can talk to the outside, injected instructions can steal data. This 'lethal trifecta' is the defining agent vulnerability. The fix is architectural, not a better prompt.

Before naming defenses, a security engineer maps the attack surface systematically. LLM apps present a wider, stranger surface than classic software. Here is how to threat-model one end to end.

base64, leetspeak, invisible Unicode, and foreign scripts each let a payload look like gibberish to your filter yet read as a clear instruction to the model. The signal is knowing why the model decodes what the classifier cannot.

An agent that trusts its tools and its own memory can be redirected by one poisoned record that resurfaces turns or sessions later. The signal is treating persistent state as an attack surface, not just the live prompt.

A hijacked agent does not need a 'send email' tool to leak secrets. A rendered markdown image, a URL parameter, or a DNS lookup will do. The signal is enumerating the covert channels and locking down egress, not just tools.

Asking the model to keep secrets or enforce permissions puts the job on the wrong component. The signal is enforcing access control before retrieval, in code you trust, and treating the LLM as untrusted compute over data that is already authorized.

Your guardrail reads text. The attack is not in the text. That single sentence is the whole vulnerability, and the red team you build from it looks nothing like the one you already have.