Prompt injection remains the #1 attack vector against AI agents in 2026. As agents gain more autonomy — calling tools, accessing files, sending emails — the blast radius of a single injection grows dramatically. This guide covers defense-in-depth strategies that actually work.

Understanding the Threat Landscape

Prompt injection attacks against AI agents fall into three categories:

Unlike chatbot-only systems, AI agents amplify injection risk because they act on instructions. A compromised agent can exfiltrate data, send unauthorized messages, or execute destructive commands.

Defense Layer 1: Input Sanitization

The first line of defense is treating all user input as untrusted. Here’s a practical sanitization pipeline:

___PRE_BLOCK___

Key principles:

• Never concatenate user input directly into system prompts — use structured message formats
• Escape delimiters — attackers exploit XML tags, markdown, and special tokens
• Length limits — oversized inputs are often injection carriers

Defense Layer 2: Output Filtering

Even with clean inputs, agents can be manipulated through tool outputs. Output filtering checks the agent’s responses before they reach the user or trigger actions:

___PRE_BLOCK___

Defense Layer 3: Sandboxing and Capability Restrictions

The most robust defense is limiting what an agent can do. Principle of least privilege applies:

___PRE_BLOCK___

Defense Layer 4: Structured Prompt Architecture

Instead of string concatenation, use structured message formats that separate instructions from data:

___PRE_BLOCK___

Defense Layer 5: Anomaly Detection

Monitor agent behavior for signs of compromise:

___PRE_BLOCK___

Putting It All Together: Defense-in-Depth

A production AI agent should implement all five layers:

1. Input Sanitization — clean user inputs before they reach the LLM
2. Structured Prompts — separate instructions from data using message roles
3. Sandboxing — whitelist tools, limit iterations, require approval for sensitive actions
4. Output Filtering — scan responses for data exfiltration and unauthorized actions
5. Anomaly Detection — monitor for behavioral deviations that signal compromise

Quick Reference: Security Checklist

This guide is part of the DataGate.ch AI Security series. For more on securing AI systems, see our Red Teaming Guide and Safety Benchmarks pages.