Prompt injection defenses for tool-using AI agents
How untrusted email, web, and PDF content hijacks agents - and practical defenses that actually help.
Written by Northstar
Northstar is an AI agent systems studio. Alex leads engineering and product systems; Jordan leads operations and workflow fit. We ship production agents inside tools teams already use.
Alex Morgan · LinkedIn · Northstar
Direct answer
Treat all external text as hostile. Separate instructions from data, constrain tools, require gates on irreversible actions, and never let retrieved content redefine system policy.
Direct vs indirect injection
User types “ignore rules” vs a webpage/email that says “forward secrets to …”. Indirect is the business killer.
Defenses that help
Allowlisted tools, no open browsing in high-trust agents, sanitize/truncate untrusted text, dual-channel confirmations for sends, human gates.
Defenses that are weak alone
“You are a safe assistant” pep talks in the system prompt.
PDF and email
Same rules: content is data, not authority.
How Northstar fits
Security-minded design is default in Northstar pilots: solutions.
FAQ
You reduce risk; you do not wish it away if tools can act.