Designing AI agents to resist prompt injection

ABSTRACT

OpenAI frames prompt injection not as simple string-matching but as an evolving social-engineering-like threat that targets tool-using agents. The post defines the problem of malicious external content steering agents into risky actions. It then proposes constraining impact via architecture (source/sink thinking), defense-in-depth, and explicit control over high-risk capabilities.