How it works
A trusted component plans actions from the user's request alone; untrusted content is handled separately and constrained by capabilities, as in CaMeL, the dual-LLM pattern, and plan-then-execute designs.
Costs some capability and does not stop manipulation within the actions the plan permits.
What we know
1 corroborated, 1 revalidateRecords over time
Use the arrow keys to move between records, Home and End to jump to the first and last, and Enter to select one.
Select a mark to read the record. Mark size shows editorial significance. Hollow marks are dated to the month. Era bands are editorial labels.
Records in view
2 records · newest firstAuthors from Invariant Labs, IBM, ETH Zurich, Swisscom, Google, Microsoft and others propose six design patterns that limit what injected text can do, such as action-selector, plan-then-execute, dual LLM, LLM map-reduce, code-then-execute and context minimization. They discuss utility and security trade-offs and illustrate the patterns with ten application case studies.
Debenedetti and colleagues (Google, Google DeepMind, ETH Zurich) propose CaMeL, which extracts control flow from the trusted user query so untrusted data cannot change which actions run, and attaches capabilities to data to block unauthorized flows. On AgentDojo the first version reported 67% of tasks solved with provable security; the June 2025 revision, with newer models, reports 77% versus 84% for an undefended system.