LANDMARK · 8 MIN · BUILD
Prompt injection defenses
After this landmark, you can name the architectural defenses against prompt injection that hold up better than instruction filtering alone.
You can still explore it. We’re showing the shared explanation and a related practical view without hiding the knowledge.
Judge’s prompt-injection landmark establishes the problem: content a model reads can carry instructions it follows. This landmark is about building the defense. No filter reliably catches every injected instruction, attackers iterate around filters faster than filters improve.
The defenses that actually hold are architectural: separate the model’s read permissions from its write/act permissions so following a malicious instruction can’t cascade into an action; put a human checkpoint before any irreversible or high-impact action; sandbox anything that ingests untrusted content; and log what the system read versus what it did, so an injection attempt is visible after the fact even if it wasn’t blocked before.
This is the canonical concept. It stays the same across learner lenses so personalization never changes the underlying facts.
What this looks like for you
If an AI tool reading a web page or email suddenly seems to be following instructions from that content, treat the output as compromised for that session and don’t act on anything it suggests until you’ve re-verified it yourself.
MAKE A DECISION
A team is building a customer-support agent that reads incoming tickets and can send replies. Which defense matters most against prompt injection?
CARRY THISFor one AI system with tool access you use or build, check: does it separate reading untrusted content from taking action, or can the two happen in the same unchecked step?
- OWASP Top 10 for LLM Applications 2025), LLM01: Prompt InjectionOWASP Gen AI Security Project · 2024-11-18
First-pass citations, limited to primary sources; a reviewer will broaden and verify these before this entry leaves draft.