Module 1 · Architecture · Lesson 3
Security and prompt injection
Every contract, report and email your agent reads was written by someone else. How indirect prompt injection works, why filters can't be the main defence, and how to design agents so injected text can't trigger anything that matters.
By the end of this lesson you can
- Explain indirect prompt injection and why language models can't reliably separate instructions from data
- Threat-model an agent with the lethal trifecta and identify which leg to remove for each workflow
- Compute the residual risk of probabilistic defences, and contrast it with architectural guarantees
- Apply least privilege, sandboxing, approval gates and quarantined extraction in Claude Code, the Agent SDK and eve
- Keep tenants' and cases' data isolated so one customer's documents can't reach another's