Defending Against Prompt Injection: Multi-Layer Security Design Patterns Based on AgentCore

When deploying LLM-based agents to production, the biggest threat is Prompt Injection. Many teams try to solve this by specifying security rules in the system prompt, but since LLMs are probabilistic models, there is always the possibility that instructions will be ignored or manipulated.

In particular, Indirect Prompt Injection can occur not only through user messages but also through various paths such as tool responses, RAG search results, and memory summaries. According to Anthropic's Agent Red Teaming (ART) benchmark, even the most powerful models succeed in several attacks out of 100 attempts, showing that perfect defense is difficult.

Therefore, the security boundary must be located outside the LLM. Key response strategies are as follows.

• Agent Permission Management: Avoid the anti-pattern of directly including user_id in Tool parameters. Instead, the agent should not be aware of the user ID, and the system should inject user information at the time of the call.
• Preventing Information Leakage: Sensitive fields should be removed from the tool's response data in advance to limit the scope of information passed to the model.

Ultimately, rather than entrusting security to the model's judgment, a design that enforces data access permissions through system-level control is essential.