Direct versus indirect injection and agent defenses

What's really being asked

The interviewer wants to see that you understand why autonomous, tool-using agents dramatically raise injection risk, especially via untrusted external content, and that you can design layered, least-privilege defenses rather than a single filter.

The full answer

The distinction: direct prompt injection is when the attacker is the user, typing instructions that try to override the system prompt. Indirect prompt injection is when malicious instructions are planted in third-party data the agent consumes, a web page it browses, a document it retrieves, an email it reads, or an API response, so the agent encounters the payload as ordinary content and may execute it, even though the human user is innocent. Indirect injection is especially dangerous for agents because they can take real-world actions through tools. Multi-layered defense: first, treat all fetched and retrieved content as untrusted, delimit and label it clearly as data, and run injection detectors and content sanitization before it enters the prompt. Second, apply least privilege to tools and APIs, scope credentials narrowly, restrict which actions are callable in a given context, and avoid giving the agent broad write or financial capabilities by default. Third, require explicit human confirmation for high-impact or irreversible actions like sending money, deleting data, or emailing externally. Fourth, monitor and log all tool calls and outputs, add anomaly detection and rate limits, and run output guardrails. Defense in depth means no single bypass is catastrophic.

The mistakes people make

Addressing only direct injection and trusting browsed or retrieved content. Relying on a single system-prompt instruction to ignore injections. Granting the agent broad tool permissions and no human-in-the-loop. Assuming output filtering alone protects against malicious actions.

What usually comes next

Why is indirect injection worse for agents, it triggers real actions. How does least privilege limit blast radius. When require human confirmation. How do you detect anomalous tool sequences.

A concrete example

An agent summarizing a web page hits hidden text saying transfer funds using the payment API. With untrusted-content labeling, a scoped read-only tool set, and human confirmation gating any payment, the injected instruction is contained instead of executed.