Prompt Injection, Secrets, and the Confused Deputy

Prompt-only defense, Capability isolation, and Human confirmation sit at different distances from the model. Only the model-independent ones are boundaries. A prompt asking the model not to obey hostile text is a request. A capability the model does not have is a wall.

That difference has a published price. Browser-using Claude was red-teamed across 123 adversarial test cases representing 29 attack scenarios. Anthropic reported the result in 2025: “Browser use without our safety mitigations showed a 23.6% attack success rate when deliberately targeted by malicious actors.” System-prompt changes, high-risk site blocking, action confirmations and classifiers brought 23.6% down to 11.2% in autonomous mode. That is the model-side layer working. It is also that layer's ceiling. The residual 11.2% was the stated reason the product shipped to 1,000 pilot users and no further.

One narrower set did reach zero. Four browser-specific attack types made up a “challenge” set — among them hidden DOM form fields, URL text and tab titles. There the same programme went from 35.7% to 0%. Exclude a class of attack structurally and the number reaches zero. Leave it in, and mitigation leaves a remainder. Someone has to live with the remainder.

The defense holds when hostile text can neither widen what the agent is allowed to do nor pull a credential out of it. It has failed once a trusted agent can become a deputy for an untrusted document, acting on instructions that arrived inside the text it was only supposed to read.

A prompt injection has a CVE number, filed by a vendor against its own assistant. CVE-2025-32711 was published on 11 June 2025, with Microsoft as the assigning CNA, under the title “M365 Copilot Information Disclosure Vulnerability.” The record's description is a single sentence: “Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.” Microsoft classified it CWE-74 — improper neutralization of special elements, the injection family. It scored the record CVSS 3.1 base 9.3 CRITICAL, vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N. NVD's own primary score for the same record is 7.5 HIGH. Aim Labs reported it and named the attack EchoLeak.

Read the vector rather than the headline number. The vector is the evidence. AV:N — the attack arrives over the network. PR:N — the attacker holds no privileges on the target. UI:N — the victim does not have to click anything. S:C — the impact crosses out of the scope of the vulnerable component. Nothing in that string requires a stolen credential or a user mistake. The attacker supplies text. An assistant that already holds the authority does the rest, through tools it was meant to use.

The two scores are worth noticing too. Microsoft says 9.3; NVD says 7.5. Even the people scoring the same record disagree about how much of an assistant's borrowed authority counts as impact.

Hostile text enters at Untrusted sources. It then has to fail at the Authority boundary, the Secret boundary, and the Action boundary in turn. The Action boundary and Detection and response should belong to different owners, with a test each.

InjecAgent is that diagram in dataset form. Published in 2024, it is 1,054 test cases covering 17 user tools and 62 attacker tools, split into direct-harm and private-data-exfiltration intents. The asymmetry between those two counts is the map: 17 tools the user meant the agent to have, 62 the attacker would like it to reach. Zhan and colleagues report a rate, not a warning: “We conduct a comprehensive evaluation of 30 different LLM agents and show that agents are vulnerable to IPI attacks, with ReAct-prompted GPT-4 vulnerable to attacks 24% of the time.” Success rose further when the injected instruction was reinforced with a hacking prompt.

So hostile text does not merely get in. Across 30 agents it got through roughly a quarter of the time against one of the strongest configurations tested. What matters is which of the three boundaries stops it after that.

Prompt injection occurs when untrusted content influences the model to violate the intended instruction or authority hierarchy. In an agent that trick becomes more dangerous. The runtime may expose tools, credentials, memory, and whatever the agent can message next.

No prompt can reliably convert arbitrary hostile content into trusted instruction. The runtime must enforce security outside the model, through isolation, data-flow controls, least privilege, approval, and verification. Outside the model is the operative phrase. Every control that lives in the prompt sits in the same channel as the attacker's text, and can be argued with.

CaMeL is what that phrase looks like once someone builds it. Debenedetti and nine colleagues published it in 2025. It extracts control and data flow from the trusted query, so untrusted data can never affect program flow. It attaches capabilities to values, so security policies are enforced at tool-call time rather than negotiated at prompt time. The abstract also states the price: “We demonstrate effectiveness of CaMeL by solving 77% of tasks with provable security (compared to 84% with an undefended system) in AgentDojo.” Seven points of task completion, in exchange for a boundary that does not depend on the model's cooperation. That trade is the real content of the principle. A lesson that only says security must live outside the model never has to name what it costs.

Everything rests on one property: untrusted content cannot directly expand tool authority or reveal credentials. Test it by writing the attack yourself and watching where it stops. There is already a peer-reviewed harness for doing exactly that. AgentDojo, presented at NeurIPS in 2024, is a dynamic environment, and its abstract states its unit of measurement: “We populate the environment with 97 realistic tasks (e.g., managing an email client, navigating an e-banking website, or making travel bookings), 629 security test cases, and various attack and defense paradigms from the literature.” Each of those 629 cases pairs a benign user task with an attacker injection task — stealing credit card data, for instance — across email, e-banking, travel and Slack environments. Benign task crossed with injection task is the shape your own ledger needs. It is what turns a signal into something countable.

Then work through the rest of the ledger one item at a time. Check that “Sensitive data cannot flow to arbitrary destinations selected from external text”. Check that “Injection attempts are visible in evals and production traces”. Check that “Compromised memory, credentials, or sessions can be revoked and repaired”. Each of those holds only if it survives repeated and adversarial attempts. Not one clean run: 97 tasks and 629 paired security cases is the order of magnitude the question deserves.

Map the untrusted inputs, the sensitive assets, and the paths between them for one workflow that browses or reads mail. Every path you can draw is one an attacker can walk. The map is what makes the deputy problem concrete. Which piece of text, arriving from outside, could get the agent to act on its behalf? That is the (SYSX)BILL of your own system — the filename the runtime will honour because of authority it granted for another reason.

Do not build the fixtures from scratch. InjecAgent's split of 17 user tools against 62 attacker tools tells you what the inventory columns are. AgentDojo's pairing of a benign user task with an attacker injection task, 629 of them, tells you what one test case looks like. Adopt that unit and your threat model produces a number rather than a diagram.

The paths that stay closed after you add capability limits and confirmation steps are the evidence that hostile text cannot widen authority or leak a secret on its own. The move from 35.7% to 0% on one narrow class is what a closed path looks like when it closes. The 11.2% that remained is what an open one looks like when you have run out of prompt-side moves.

Assume some injection attempts will influence the model. That is now a finding rather than a posture. A large-scale public red-teaming competition drew 464 participants, who submitted 272,000 indirect-prompt-injection attempts against 13 frontier models across tool-calling, coding and computer-use settings. Gray Swan hosted it; NIST's Center for AI Standards and Innovation (CAISI), the UK AI Security Institute and frontier labs analysed the results. There were 8,648 successful attacks over 41 scenarios, and every model was breached. Per-model attack success rates ranged from 0.5% for Claude Opus 4.5 to 8.5% for Gemini 2.5 Pro, and universal attacks transferred across 21 of the 41 behaviours. As CAISI put it: “Across more than 250,000 attack attempts from over 400 participants, at least one successful attack was found against all of the target frontier models, highlighting the ongoing challenge that hijacking attacks pose for secure agent use.”

Two numbers there decide the design. The best rate in the set was 0.5%, not zero. A system that is safe only when the model refuses is a system with a known failure rate. And 21 of 41 behaviours means one attack often works in more than one place. Each success is a class of successes, not an incident.

Design the system so influenced text still cannot cross sensitive data or action boundaries. A useful threat model therefore names the confused-deputy attack as the thing to prevent. The agent is trusted, the document it reads is not, and the document ends up spending the trust the agent was given. Then it names the property that defeats that attack. Whatever the text says, it cannot by itself hand the agent new authority or pull a credential into the open.