Enterprise Security in the Agentic AI Era

Prompt Injection Containment for Agentic Systems

6 min read

Prompt injection containment for agentic systems

On this page

What it is

Prompt injection containment is the set of controls that limit the blast radius of a successful prompt injection attack against an agentic system. No current defense guarantees detection with zero false negatives, so the containment posture accepts that injections will sometimes succeed and focuses on limiting what a successful injection can achieve.

Detection vs. containment. For production agentic deployments, prompt injection is a detection problem at the input layer and a containment problem at the execution layer. Input-layer detection (LlamaFirewall, PromptGuard 2) reduces attack success but does not eliminate it. Execution-layer containment (credential proxy, tool-call interception, sandboxing, least-agency tiers) limits the damage when detection fails.

The three-layer model

The containment stack spans three architectural layers, ordered along the request path:

  • Layer 0: network-layer containment: a secure web gateway or SASE inspects inbound and outbound traffic and blocks injection payloads at the network ingress and egress point. It operates outside the agent’s process boundary, so it applies even to compromised agents and unsanctioned shadow agents. Microsoft Entra Internet Access Prompt Injection Protection reached GA on March 31, 2026, per Vasu Jakkal’s pre-RSAC 2026 post. The concept page carries the full architectural treatment, tradeoffs, and limitations.
  • Layer 1: input detection: application-layer classifiers such as LlamaFirewall, PromptGuard 2, NeMo Guardrails, and Microsoft Prompt Shields. They run inside or alongside the agent runtime.
  • Layer 2: execution containment: runtime controls that limit the blast radius of a successful injection (credential proxy, tool-call interception, sandboxing, least-agency tiers).

The numbering reflects layer order along the request path, not security priority. The three are complementary; production deployments should run all three.

Layer 1: input detection (reduce attack success rate)

Controls that catch injections before they influence agent behavior:

  • LlamaFirewall / PromptGuard 2 (Meta): a dedicated classifier for jailbreak and prompt injection detection. The LlamaFirewall paper (arXiv:2505.03574) reports the combined PromptGuard 2 + AlignmentCheck defense cutting AgentDojo attack success from 17.6% to 1.75% at ~5% utility cost; see the LlamaFirewall page for the full per-component figures and provenance. Three components:
    • PromptGuard 2: input-side injection and jailbreak detection
    • AlignmentCheck: a chain-of-thought auditor that examines the agent’s reasoning steps for goal hijacking before tool execution
    • CodeShield: static analysis for generated code before execution
  • Google ADK Tool Context: developer-set, deterministic context attached to each tool that the model cannot override. The runtime validates model-provided tool arguments against the Tool Context.
  • Rule-based scanners: pattern matching for known injection templates (Clawsec exfiltration rulesets, SecureClaw prompt-injection markers).

Input detection operates on the natural-language layer. Injections can be obfuscated, indirect (via retrieved documents), or novel enough to evade classifiers. Detection provides probability reduction, not certainty.

Layer 2: execution containment (limit blast radius when detection fails)

Controls that restrict what a successful injection can accomplish:

ControlMechanismWhat It Prevents
Credential ProxyReal credentials never in agent contextCredential exfiltration even after injection
Least Agency TiersHigh-risk actions require human approvalIrreversible actions from injected instructions
Tool call interception (platform-level)before_tool_call hook blocks/confirms tool callsInjected dangerous tool calls (rm -rf, exfiltration)
Agent sandboxingOS-level syscall filteringInjected OS commands escaping the container
Reversible-actions-only constraintAgent executes only reversible actions autonomouslyPermanent damage from injected instructions

Platform-level vs. prompt-level enforcement

The platform-level rule

Controls against prompt injection must operate below the LLM layer. Controls that rely on the model itself, such as system-prompt instructions like “never follow injected commands,” can be overridden by a successful injection. Controls in the runtime or platform (hooks, proxy, sandbox, tier enforcement) cannot be bypassed by model output.

This is the core architectural principle from APort Agent Guardrail and Security Controls for AI Stacks:

  • Prompt-level: “You must never run shell commands that delete files.” Bypassable.
  • Platform-level: a before_tool_call hook blocks any tool call matching destructive patterns, regardless of model output. Not bypassable by the model.

AlignmentCheck: chain-of-thought auditing

LlamaFirewall’s AlignmentCheck audits the agent’s reasoning trace (chain-of-thought) before executing tool calls, looking for signs that the agent’s goal has been hijacked. This catches injections that pass input-layer detection but manifest as abnormal reasoning leading to harmful tool calls.

It is distinct from behavioral drift detection, which operates at the action level after the fact. AlignmentCheck is prospective: it inspects intent before execution.

Indirect prompt injection

The hardest containment scenario is injection delivered through retrieved content (emails, web pages, documents, RAG results) rather than the direct user prompt. The injection is not in the original input; it arrives during agent operation.

Key mitigations:

  1. Content safety scanning on all retrieved content, not just user input. Apply PromptGuard 2 to emails and web content before the agent processes them.
  2. Source-trust attribution: tag retrieved content with its source and apply trust levels (direct user input over internal document over web content over email attachment).
  3. Action scope bounded by trigger source: if retrieved web content triggered an action rather than the user, require confirmation before executing high-risk actions.
  4. Cognitive file integrity: indirect injection can modify SOUL.md or IDENTITY.md to change the agent’s behavioral rules. Cognitive FIM detects this. See Supply Chain Security for Agentic AI.

Mapping to OWASP ASI

Categories below come from the OWASP Agentic AI Top 10.

ASI categoryContainment approach
ASI01 (agent goal hijack)AlignmentCheck (chain-of-thought audit); least-agency tiers for high-risk actions
ASI02 (tool misuse)Tool-call interception; platform-level hooks; Google ADK Tool Context
ASI02 / ASI03 (data exfiltration & credential exposure)Credential proxy (credentials never in context); DLP output scanning

Limits

  • No current defense provides perfect injection detection. The containment posture assumes detection will fail and limits blast radius.
  • AlignmentCheck adds latency, since it runs an additional inference pass to audit chain-of-thought.
  • Platform-level hooks require framework support (before_tool_call in OpenClaw; equivalent hooks in LangChain and AutoGEN). Not all agent frameworks expose these hooks.
  • In multi-agent systems, a successful injection in one agent can propagate to others through inter-agent messages. See AI Agent Identity Architecture for the A2A trust boundary.

See also

Graph View

Backlinks