Detection is a layer, containment is the strategy
Lesson 5 of 5 in Prompt Injection: The Vulnerability With No Patch.
Here is the whole module in one move. You cannot stop the model from being persuaded, so stop the persuasion from mattering. Every durable defence answers one of two questions: what can this agent reach, and where can anything it produces go.
Two frameworks make that concrete, and they are close cousins. Willison’s lethal trifecta (16 June 2025) names the combination that turns injection into data theft: access to private data, exposure to untrusted content, and the ability to communicate externally. All three in one agent and, in his words, an attacker can easily trick it into fetching your private data and sending it to them. His conclusion is deliberately unglamorous — since guardrails that catch 95% are a failing grade, the dependable protection is not combining all three.
Meta’s Agents Rule of Two (31 October 2025) turns that into a design rule: until prompt injection can be reliably detected and refused, an agent session should satisfy at most two of [A] processes untrustworthy inputs, [B] has access to sensitive systems or private data, [C] can change state or communicate externally. If a task genuinely needs all three, it should not run autonomously — it needs supervision such as human approval or another dependable validation mechanism. The two frameworks are structurally near-identical; treat the Rule of Two as the buildable version of the trifecta warning. (Whether Meta’s post credits Willison is not something to assert either way.)
Containment layers — strongest at the apex
- Architectural separation — break the trifecta; the attack has nowhere to land
Design so no single session holds untrusted content and privileged data and an outbound path. Split into contexts with different trust levels, pass only structured, validated data between them, and give the privileged step no exposure to raw attacker text. Strongest layer because it removes the capability the attack needs rather than trying to detect the attack — and the layer you can only get by choosing it early.
- Least privilege and scoping — the injection succeeds and can still do nothing
Give each session the narrowest set of tools and the narrowest credential that completes the task: read-only where possible, one repo, one mailbox, one tenant, one row range. This is the link the attacker cannot argue with — a tool that is not attached cannot be called, however persuasive the text. Invariant’s recommended fix for the GitHub MCP flow was precisely this shape.
- Egress control — close the road out
Constrain where data can go: allowlist destinations, refuse to render remote images and attacker-supplied links, block or proxy outbound HTTP, and log every destination. This is the link most vendors patched — GitLab refusing to render unsafe HTML tags pointing outside gitlab.com, Salesforce enforcing Trusted URLs, GitHub disabling image rendering in Copilot Chat. Design it as an allowlist you own: AgentFlayer defeated a reputation-based check with rented Azure storage, and ForcedLeak rode an allowlisted domain that had quietly expired.
- Human gates and approvals — a checkpoint — while it is still real
Require approval for irreversible, outbound, and cross-boundary actions, and show the reviewer what actually matters: the recipient, the destination, the diff, the amount. Ranked below egress control because gates decay. Invariant noted users routinely click “Always allow”, and a gate that almost always says yes trains the reflex that removes it — so monitor review time and rejection rate as metrics, and keep a kill switch wired.
- Detection and monitoring — necessary, never sufficient
Injection classifiers, provenance and spotlighting techniques, anomaly detection on tool sequences, and full traces of every run. Broad and cheap, so run it — it cuts opportunistic attacks and it is how you learn you were targeted. It is at the base because it is probabilistic against an adaptive adversary: 95% is a failing grade for a boundary, and a fine result for a filter. Its best output is often the alert, not the block.
Tool: Prompt Injection Range — Take it to the range: the Injection Range drops you into agent configurations with different trifecta legs attached, and asks you to predict — then verify — which containment layer stops each chain.
Interactive flashcard deck.
Interactive checkpoint quiz (2 questions) — open this page in a browser to take it.