Findings/constrain-what-untrusted-input-can-trigger

Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.

Corroboratedargued5 evidence records from 4 independent sourcesassistant-drafted

Scope: what this does not show

A design position that several parties converge on. It trades away capability and is not a measurement.

Corroborated: Supported by at least two independent sources.

Evidence

Jun 10, 2025

Researchers from labs and industry publish design patterns for provably injection-resistant agents

arXiv

Jun 16, 2025

Simon Willison frames the 'lethal trifecta' of private data, untrusted content and exfiltration

Simon Willison's Weblog

Oct 31, 2025

Meta proposes the 'Agents Rule of Two' for limiting prompt injection impact

Meta AI

Jan 28, 2026

OpenAI describes Safe Url check that only auto-fetches URLs already seen publicly to block exfiltration

OpenAI

Feb 13, 2026

OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT to limit prompt injection exfiltration

OpenAI

How it relates to other findings

supportsqualifiescontestssupersedes

ReportedCorroboratedQualifiedContestedSupersededRevalidate· node size = evidence records · columns group by topic

Select a finding to see how it relates to others. Arrows point from the newer finding to the one it supports, qualifies, contests, or supersedes.

This finding supports Separating an agent's control flow from untrusted data can give provable protection against control-flow hijacking at a modest utility cost.CaMeL is one implementation of this principle.

Key questions that rely on this finding

Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.

Status history

2025-06-10ReportedDesign patterns paper argues for constraining agents. · record
2025-06-16CorroboratedIndependent framing of the same principle as the lethal trifecta. · record
2026-09-25CorroboratedcorrectionWillison's post quotes and builds on the design patterns paper, so it is not independent of it. Corroboration rests on separate organizations adopting the position, such as OpenAI's deterministic Lockdown Mode. · record

What would change this: A deployed system where architectural constraints were bypassed without a model failure.
Evidence kind: argued: A position, framework, or analysis.
Freshness: Evidence 225d old · recheck in 505 daysNewest evidence Feb 13, 2026. Half-life 730 days.
Methods tested: Data exfiltration through agents Restricting what agents can reach Separating control flow from untrusted data Indirect prompt injection
Topics: Prompt injection Data exfiltration
Attack surface: Untrusted content Tools & MCP Credentials
Fide research: FID-074: Agent alignment and runtime assurance

Cite this record

Fide AI. "Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.." Agentic Cyber Explorer, record constrain-what-untrusted-input-can-trigger. https://agentic-cyber-explorer.pages.dev/findings/constrain-what-untrusted-input-can-trigger/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-constrain-what-untrusted-input-can-trigger,
  author = {{Fide AI}},
  title = {Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/findings/constrain-what-untrusted-input-can-trigger/},
  note = {Record constrain-what-untrusted-input-can-trigger; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Know of evidence that changes this? Tell us.