Prompt injection & untrusted content

Welcome to AI & Agent Application Security — the surface LLM and agent systems add on top of everything in P52–P57, and the discipline's distinctive pillar. Its defining problem is the instruction/data boundary: a model reads text, and text that looks like an instruction can be treated as one. When that text arrived from a web page, a document or a tool result, the attacker wrote it — indirect prompt injection.

This track builds the two defences that carry most of the weight: quarantining retrieved content so it enters as clearly-marked data, and privilege separation in prompt assembly so untrusted content can never reach the trusted instruction channel.

The honest framing this pillar keeps throughout: these mitigations reduce risk, they do not eliminate it. That is precisely why the agent track puts irreversible actions behind a gate. Every kata here is defence — hostile-looking strings appear only as inputs your code must handle safely.

The code runs entirely in your browser (Pyodide) — no model is called, no agent is run.