# AI agents: keep untrusted content away from authorization decisions

Canonical: https://www.web3sec.news/blog/ai-agents-prompt-injection-boundaries
Author: Raiders (https://www.web3sec.news/about)
Format: analysis
Topic: AI security
Published: 2026-11-08
Updated: 2026-11-08

A practical control model for assistants that read the web, inspect repositories and act through connected tools.

### Diagram: Content is evidence. Approval is authority.

Keep source material separate from the authority to act.

![Sources enter a working context and produce a proposal. A separate approval gate checks scope before a tool action. Untrusted content cannot authorize execution.](https://www.web3sec.news/diagrams/trust-boundary.svg)

[Full-size SVG](https://www.web3sec.news/diagrams/trust-boundary.svg) · [PNG download](https://www.web3sec.news/diagrams/trust-boundary.png)

Original explanatory control model; not a reconstruction of private incident evidence.

## The risk follows the tools

Anthropic’s November 2025 browser-agent research describes prompt injection as malicious instructions embedded in material an agent encounters. It emphasizes that stronger model defenses do not make browser agents immune. The research discusses hidden content that attempts to redirect an agent from its legitimate task toward unauthorized actions.

Our analysis: the consequential question is what a successful redirection can cause. A summarizer with no external tools has a different risk profile from an agent that can read private files, send messages, change cloud settings or authorize a treasury operation.

## Build controls outside the model

Separate retrieved content from trusted task instructions. Do not let a document, repository comment or tool response grant itself additional permissions. The component that approves an action should evaluate the user’s intended operation and the proposed destination, rather than trusting the agent’s explanation alone.

Give each task only the tool scopes and data it requires. Use short-lived credentials, explicit destination restrictions and isolated execution environments. Require a concrete review for irreversible actions: the exact transaction, recipient, changed permission or data being sent should be visible before approval.

## Test and observe the complete workflow

Test realistic hostile content in staging: a retrieved document asking for secrets, a repository issue that impersonates an administrator or a tool result that proposes a new upload destination. Verify that policy prevents the action even if the model follows the injected instruction.

Keep an action log with the initiating request, tools invoked, destination and authorization decision, while redacting secrets. Add a kill switch and per-task execution limits. Measure unauthorized actions and data exposure, rather than treating refusal text as sufficient proof of safety.

## Controls to take away

- Treat retrieved content as data, not authorization.
- Enforce tool scopes and destination rules outside the model.
- Test whether hostile content can trigger an unauthorized action.

## Work through the boundary

Local planning worksheets; they do not inspect or change accounts or environments.

- [Build a permission review plan](https://www.web3sec.news/tools/agent-permissions): Select the capabilities you are considering and review approvals, revocation and evidence before connecting an agent.

## Sources & further reading

- [Anthropic: mitigating prompt injection in browser use, 24 November 2025](https://www.anthropic.com/research/prompt-injection-defenses)

Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis.

[Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)