Concept

• Agent System-Level Defenses - Isolation, approval gates, scope filters, and input/output guardrails that contain damage when prompt defenses fail on a tool-using agent.
• ChatML Injection Resistance - Reserved role-marker tokens can't be produced by ordinary user text, so an API caller is structurally confined to the user role and cannot fake turns.
• Confused Deputy - An agent holding legitimate tool authority is steered by untrusted content into spending that authority on an attacker's instruction instead of its user's — the authority is real, only its source of direction is hijacked.
• Contain at the Environment Layer First - Contain agents with deterministic environment boundaries (filesystem, egress, OS sandbox) first and steer at the model layer second, matching isolation strength to how well the overseer can evaluate the agent's actions.
• Credentials Stay Outside the Sandbox - Keep tokens in a vault or proxy, or bind them to resources at initialisation, so the agent and its sandbox never see them; where an agent must hold credentials, give it test-only, budget-capped ones.
• Defensive Prompt Engineering - Design system prompts and input handling so untrusted user content cannot override developer instructions or exfiltrate privileged context.
• Hardline Command Floor - Beneath configurable approvals, keep an un-overridable floor of blocked actions that protects non-negotiable targets such as volumes, state databases and secrets, and fail closed on anything that cannot be parsed.
• Immutable Agent Guardrails - An agent's standing rules and harness state should sit where it cannot rewrite them, with each attempted edit needing a fresh human approval and the OS sandbox mounting those directories read-only, so either layer alone blocks the change.
• Indirect Prompt Injection - Malicious instructions planted in tool outputs or retrieved documents that the agent treats as trusted commands once they enter context.
• Injection Defences Are Bypassable - Adaptive attacks bypassed 12 published prompt-injection defences at over 90% success and human red-teams always succeeded, so model-layer defences are one layer of protection, never the security boundary.
• Input Output Guardrails - Harness checks on prompts and generations that block leaks, attacks, and bad outputs — with explicit policies per failure mode and false-refusal awareness.
• Inspect Tool Output Before It Enters Context - Tool output is an attack surface even from trusted tools, and remote MCP servers can change after approval, so inspect returns and context files with a small classifier or pattern scanner before they reach the model.
• Instruction Hierarchy - Train and design so conflicting instructions resolve toward higher-privilege layers — system over user over model output over tool output.
• Jailbreaking and Prompt Injection - Subverting safety features or injecting malicious instructions so the model follows attacker goals instead of developer policy.
• Layered Agent Permission Stack - Production harnesses layer execution policy, lifecycle hooks, LLM or human approval and OS sandboxing; cheap guardrails can run optimistically in parallel where early execution is harmless, and a reasoning-blind classifier can replace per-action human approval.
• Logs Are Untrusted Input - Logs and alert payloads are attacker-influenceable, so an agent that reads them must keep them out of its instruction channel, preserve field provenance and constrain its outputs, because naive defences let persona hijack and context manipulation through.
• Memory Hacking - Adversarial conversation that implants false past events into an agent’s durable memory — a retrieval/reflection risk beyond ordinary prompt injection.
• Prompt Extraction - Attacks that trick a model into revealing its system prompt or privileged context so an application can be replicated or exploited.
• Prompt-Level Attack Defenses - Explicit refuse rules, reinforced system instructions, and known-attack preemption inside the prompt — useful layers that never guarantee obedience.
• Publish-State Protection Guard - Once an agent's own end-state check passes, intercept later destructive commands against that verified output at the tool level so a "tidy up" pass cannot erase what was just proven correct.
• Safe Search Argument Passing - Wrap agent search queries so strings that look like CLI flags (e.g. --notes) are never parsed as options by underlying grep/find tools.
• Staged Command Approval - Split a compound shell command into stages and resolve each against policy, so only complete, known-safe stages clear automatically, one rejected stage denies the whole command, interpreters never get prefix grants, and a deny always beats an allow.
• The Agents Rule of Two - An autonomous agent should hold at most two of untrusted input, sensitive access, and state change or external communication; holding all three needs a human in the loop, because that combination enables exfiltration.
• The Docker Socket Is Root - Mounting the container daemon socket into an agent or sidecar grants host-root equivalence, so any prompt injection becomes host compromise; restrict it like root access and prefer hardened container flags.
• Untrusted Input Must Not Trigger Actions - Once untrusted content enters an agent's context, the architecture rather than model robustness must stop it from causing consequential actions, through injection-resistant design patterns or CaMeL-style control/data-flow separation.