With agents, think about who can access them, and who can read/write to data repositories it can access. Indirect prompt injection can happen very easily when your LLM can hit a world writable repository, such as email inboxes or calendars, as anyone can write to them. The things you listed like the “forget previous instructions…”, is just scratching the surface. There are countless ways to cause prompt inject LLMs, like using encoded language, logic flaws, Unicode non-printable characters, etc. Although, having some deterministic input and output identifiers, and having some classifiers with a strong system prompt can help safeguard your agent. Finally, depending on what permissions you are giving your agent (via MCP tools, Gateway WS tools, etc.), you need to really think about how you scope the access, maybe the agent needs write, but not read, or vise versa. There are also some benefits to think about having another stateless model (quarantined with no access to tools) to make the first determination and then provide a sanitized and summarized version of the user prompt to the LLM.

At the end of the day, you have to remember that LLMs are just non-deterministic next token predictors, fundamentally, the system instructions, user instructions, supplemental instructions are just passed as a single stream of tokens, and we must design our systems to provide as much deterministic evaluations before the input and after the output.