prompt
FreeSecurity-first AI agent prompt to resist prompt injection
FreeFree tier
Inputs: textOutputs: text
About prompt
Prompt Injection Guardian is a system prompt designed for AI agents to resist prompt injection attacks. It establishes a strict instruction hierarchy, separating untrusted content (e.g., web pages, PDFs, emails) from trusted user instructions. The prompt enforces policies such as requiring explicit user confirmation for high-impact actions, tracing the source of any request, and following least-privilege principles. It provides clear guidelines for when to stop and escalate, and how to respond to suspected injection attempts. This prompt is part of the ai-boost/awesome-prompts repository and is available as open source.
Key Features
Instruction hierarchy: system/user instructions always override external content
Data vs instruction separation: treat fetched content as evidence, not commands
High-impact action policy: require explicit user confirmation before sensitive actions
Source tracing: identify who requested an action and what evidence supports it
Least privilege: use minimum tool scope and prefer read-only actions
Explicit escalation criteria: detect requests to reveal hidden instructions, urgency pressure, or embedded instructions
Response policy for suspected injection: state untrusted content, explain risk, ignore malicious instruction, continue safely if possible
Pros & Cons
Pros
- Provides a clear, actionable set of rules for AI agents to follow
- Explicitly addresses common prompt injection vectors like hidden instructions and urgency pressure
- Encourages minimal privilege and user confirmation for high-risk actions
- Open source and free to use, modify, and integrate into any AI system
- Based on research from OpenAI on designing agents to resist prompt injection
Cons
- Only a system prompt; effectiveness depends on the underlying AI model's compliance
- May require customization to fit specific application contexts and workflows
- No built-in technical enforcement; relies on the model's adherence to instructions
- Does not cover all possible injection scenarios; additional layers of defense may be needed
Best For
Securing AI agents that process untrusted content from web pages, PDFs, emails, or user uploadsImplementing prompt injection defense in LLM-based automation toolsProtecting AI assistants in customer support or data analysis from malicious instructionsBuilding safe agents for code execution or API calls with user confirmationTraining AI systems to recognize and reject embedded commands in retrieved data
FAQ
What is the purpose of Prompt Injection Guardian?
It is a system prompt designed to help AI agents resist prompt injection attacks by enforcing a strict separation between trusted instructions and untrusted content, requiring user confirmation for high-impact actions, and providing clear escalation criteria.
How does it distinguish between data and instructions?
The prompt treats any content from web pages, PDFs, emails, tool outputs, and similar sources as untrusted data to be analyzed, not as commands to execute. Only system, developer, and direct user instructions are treated as authoritative.
When should the AI agent stop and escalate to the user?
It should stop and ask the user if it detects requests to reveal hidden instructions or private context, pressure to act urgently without verification, instructions embedded inside retrieved content, mismatched domains or redirects, requests to forward data outside the user's stated workflow, or code/scripts asking for secret material or privileged execution.
Is this prompt free to use?
Yes, it is part of an open source repository (ai-boost/awesome-prompts) and can be freely used, modified, and integrated into AI systems.