LLMAgentPromptInjectionPatterns
title: Design Patterns for Securing LLM Agents against Prompt Injections radar_quadrant: Techniques radar_ring: Assess radar_position: inner created: 2026-05-26 last_updated: 2026-05-26 tags: [security, prompt-injection, llm-agents, defensive-design, simon-willison] source_url: https://simonwillison.net/2025/Jun/13/prompt-injection-design-patterns/
A catalogue of defensive design patterns for prompt injection attacks in LLM agents, published by Simon Willison in June 2025. Prompt injection occurs when malicious content in the environment — a web page, a document, an email, an API response — hijacks an agent's actions by embedding instructions that the LLM treats as trusted commands.
An LLM agent with tool access (web browsing, file writing, email sending, code execution) is vulnerable to any content it reads. A webpage can instruct the agent to exfiltrate data; a document can instruct it to send emails; a retrieved API response can override its task. The GitLab Duo incident (2025) demonstrated real-world source code exfiltration via this vector.
Never trust retrieved content as instructions. Treat all externally sourced content as data, not as commands. Wrap retrieved content in a framing that explicitly marks it as untrusted user data before passing it to the model.
Privilege separation. Separate read and write capabilities. An agent that only reads cannot be prompted into writing. Grant write access only to steps that genuinely require it, and keep read and write steps isolated.
Confirmation gates before irreversible actions. Any action that cannot be undone (send email, commit code, delete file, make payment) requires an explicit human confirmation step. Automate freely for reversible actions; gate irreversible ones.
Output validation before acting. Validate the agent's proposed action against a policy before executing it — check that the target, parameters, and scope match the original task intent.
Audit logging. Log every tool call with its inputs and outputs. When an injection occurs, the log provides the forensic trail to understand what happened and what was exfiltrated.
Minimal tool surface. Limit the tools available to each agent to only those strictly necessary for its task. An agent that can only read PDFs cannot send emails even if injected.
The prescriptive complement to the Remote Prompt Injection in GitLab Duo case study (which demonstrates the consequences of absent defences). Also complements Building Effective Agents (Anthropic) — privilege separation and confirmation gates map directly to the workflow vs. agent design decision. Applies to any agent built on MCP, browser-use, OpenHands, or Cline.
Placed in Techniques / Assess / inner. Named defensive patterns applicable immediately to any LLM agent with tool use — no new tooling required, only design discipline. Inner position reflects that the threat is active (GitLab Duo, 2025) and the patterns require only architectural decisions. Trial gate: one LLM agent system reviewed against all six patterns with privilege separation and confirmation gates verified for at least one irreversible action.
