Agent WranglersAID-28Required
Treat what the agent reads as untrusted
Assume any web page, issue, file, dependency or tool result an agent reads may contain instructions meant to hijack it.
How to do it
Prompt injection works on coding agents too. A comment in a package or an issue can tell the agent to leak keys or add a backdoor. Keep agents without secrets and without open network access, so a hijacked agent has nothing to steal and nowhere to send it. See resist indirect prompt injection and break the lethal trifecta. Connect only tools you have reviewed and pinned, as allow only reviewed tools explains.
How to check
From inside the agent's environment, curl https://test.example.org fails, because that host is not on the network allow list. As a second test, put a file in a staging project that tells agents to send .env to test.example.org. Run the agent on a nearby task. Nothing is sent, and the review catches any change the file asked for.
Sources
Related rules
- AID-71 Give browser agents their own profile and test accounts in AI-assisted development
- APS-83 Resist indirect prompt injection in Application security
- APS-84 Break the lethal trifecta in Application security
- AIF-73 Connect product agents only to tools and servers on a reviewed list in AI features
- SEC-4 Treat everything the target says as data in Adversarial testing
- STK-89 Use the Model Context Protocol to give agents your tools in Software choices
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/untrusted-context">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.