Prompt injection defenses for tool-using AI agents
How untrusted email, web, and PDF content hijacks agents - and practical defenses that actually help.
Written by Dali
Dali is an AI agent systems studio. David leads engineering and product systems; Liana leads operations and workflow fit. We ship production agents inside tools teams already use.
David Hakobyan · Dali
Direct answer
Treat all external text as hostile. Separate instructions from data, constrain tools, require gates on irreversible actions, and never let retrieved content redefine system policy.
Direct vs indirect injection
User types “ignore rules” vs a webpage/email that says “forward secrets to …”. Indirect is the business killer.
Defenses that help
Allowlisted tools, no open browsing in high-trust agents, sanitize/truncate untrusted text, dual-channel confirmations for sends, human gates.
Defenses that are weak alone
“You are a safe assistant” pep talks in the system prompt.
PDF and email
Same rules: content is data, not authority.
How Dali fits
Security-minded design is default in Dali pilots: solutions.
FAQ
You reduce risk; you do not wish it away if tools can act.