Break the lethal trifecta that turns a prompt injection into a leak

Your agent can read private data, process content from strangers, and send messages out, and you never noticed those three things add up to a leak.

Intermediate to advancedRead 9 minDoing: a couple of hours, most of it rewriting the reply tool and rerunning the planted ticket8 steps

▶ Start

What you'll have at the end

A config change that removes the model's control over where an outbound message goes, confirmed by re-running the same planted instruction and finding its marker in no destination but the account's own registered address.

Before you start

You need

You need a working agent that already reads content from outside your control, looks up a piece of your own private data, and can send a reply back out through a tool you can edit.

Not covered

This does not cover catching or classifying an injected instruction itself; it removes the exit that instruction would need whether or not anything ever spots it.

Leans on

8 steps

Where to go next

A 'read-only' database tool a prompt injection can still push into a write

the tool worth hardening is a database write path, not an outbound message channel

Red-team your agent for indirect prompt injection in fetched content

you want a repeatable test across every channel and tool this agent has, rather than only the one you just fixed

Checked 18 Aug 2026

Part of the LLM Security & Safety cookbook