Method2026-06-30#security

Prompt injection is a boundary problem

A retrieved page, webhook body, document, or user note may contain text that sounds like instructions. The model needs a rule that this text is content to analyze, not authority to obey.

The safer architecture binds tools to schemas, trusted domains, explicit user intent, protected-action checks, and refusal states. The prompt can help, but the product boundary has to carry the load.

The AHA is that security lives where text becomes action.

Aha moment

Prompt injection becomes dangerous when untrusted text crosses from content into command authority.

Try this

Place a harmless fake instruction inside retrieved content and make the model classify it as content, not a command.

Open NotesEntry JSON

Watch for

  • Untrusted pages allowed to override system or user intent
  • Tools exposed without least-authority checks
  • Warnings in prompts used instead of product boundaries