Prompt injection: what a sandbox can and can't stop

“it is unclear if there are fool-proof methods of prevention for prompt injection”

“Access to your private data —one of the most common purposes of tools in the first place! Exposure to untrusted content —any mechanism by which text (or images) controlled by a malicious attacker could become available to your LLM The ability to externally communicate in a way that could be used to steal your data”

“The only way to stay safe there is to avoid that lethal trifecta combination entirely.”

“A Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways.”

“Indirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.”

“where the user is trusted but Claude processes third-party content (webpages, emails, documents, tool results) that contains adversarial instructions”

“While these protections significantly reduce risk, no system is completely immune to all attacks.”

“Prompt injection can cause the agent to fetch and follow untrusted instructions.”

“If your agent combines these three features, an attacker can easily trick it into accessing your private data and sending it to that attacker.”

“we use a technique called sandboxing to prevent the model from making harmful changes that might be the result of a prompt injection”

“Sandbox isolation reduces the impact of a breach, but it does not eliminate risk.”

“Any approach that allows network egress can still leak data the agent can read, and any approach that mounts your project directory writable can still modify that code.”

“Isolation also does not change what is sent to the model.”

“The network proxy filters scripts, programs, and child processes that run inside the local command sandbox. It does not filter web search, app or connector tool calls, MCP server connections, browser or Computer Use activity, Codex cloud tasks, or the client's model and authentication requests.”

“Restrict the model’s access privileges to the minimum necessary for its intended operations.”

“excessive functionality; excessive permissions; excessive autonomy.”

“Where possible, limit an agent’s access to only the sensitive data or credentials it needs to complete the task.”

“Implement human-in-the-loop controls for privileged operations to prevent unauthorized actions.”

“potentially dangerous actions, or transmissions of potentially sensitive information, should not happen silently or without appropriate safeguards.”

“Put untrusted content only in tool results.”