Prompt injection in coding agents: reduce the impact

Prompt injection happens when untrusted content changes how an AI system responds or acts. In a coding workflow, the content might come from an issue, pull request, README, dependency documentation, log, fetched page, or tool response.

No text filter or carefully worded system prompt can establish that every instruction the model sees is safe. The practical goal is to limit what an agent can reach and ensure sensitive actions are checked independently of the model.

How an indirect injection can reach an action

1. An agent reads untrusted content while working on a legitimate task.
2. The content includes instructions that conflict with the user's intent.
3. The agent treats some of that content as relevant guidance.
4. A connected tool or shell command gives the agent a way to read, change, or send data.
5. The action crosses a boundary unless an independent permission or policy check stops it.

This is a threat-path example, not a report of a Rechazo test or a specific incident. OWASP describes repository files, issues, pull requests, logs, and fetched pages as possible sources in its Secure Coding with AI guidance.

Put controls where the effect occurs

Reduce what the agent can access

Limit the workspace and external destinations to the task. Use sandboxing where available, configure network access deliberately, and keep sensitive credentials outside the agent's general context. Review the sandbox's actual limits; do not assume it is a virtual machine or a replacement for endpoint security.

Make tool authority explicit

Enable only needed tools. Scope credentials and permissions narrowly. Require approval for actions that can publish, delete, change infrastructure, or send sensitive data. The approval should show the actual destination and arguments.

Validate actions outside the model

Check authorization and arguments in the trusted component that performs the operation. Do not rely on the model to follow an instruction such as “never send secrets.” When outputs move between tools, validate the destination and data flow again.

Keep detection in perspective

Pattern checks can flag suspicious text, but they cannot prove that the remaining text is safe. OWASP's prompt injection guidance recommends layered controls and independent validation rather than treating a text filter as a complete defense.

Test safely

Use synthetic secrets, a disposable repository, and mock tools with no production access. Test direct instructions and indirect content from files or tool outputs. Confirm that a denied operation cannot reach its target, and inspect what the agent records or returns. Do not test by planting real credentials or targeting third-party systems.

A short review list

• Identify every source of instructions and data the agent can read.
• Limit filesystem, network, and tool access to the task.
• Keep sensitive credentials out of unnecessary model context.
• Require independent authorization for high-impact actions.
• Treat tool results as untrusted when they enter later steps.
• Test denials with harmless data and record the exact configuration.

Sources

• OWASP LLM Prompt Injection Prevention Cheat Sheet
• OWASP Secure Coding with AI Cheat Sheet
• OWASP MCP Security Cheat Sheet
• Microsoft: Secure AI-assisted development in VS Code

Sources reviewed 25 October 2026.