Prompt injection defense for Claude agents that can write

Prompt injection is when untrusted text (a webpage, an email, a retrieved document) tries to override the instructions you gave Claude. For a chatbot that only talks, the blast radius is embarrassment. For an agent that can send mail or update Salesforce, the blast radius is a real incident.

Defense is not a magic system prompt. It is layering: untrusted content marked as data, tools that cannot do everything, and a human on the actions you cannot undo.

What we see in inherited agents

• Retrieved HTML pasted into the same channel as the system prompt
• A single tool that can read and write any object
• No allow-list of destinations for outbound messages
• Logs that cannot reconstruct which tool ran and why

Those are the same gaps that show up in HIPAA and SOC 2 Claude work. Security review will not sign a hopeful prompt.

A practical stack

1. Separate trusted instructions from untrusted text. Wrap retrieved content. Never concatenate it as if it were policy.
2. Constrain tools. Prefer "update this ticket" over "run this API." See tool schema design.
3. Require confirmation on irreversible actions. That is human-in-the-loop, not polish.
4. Red-team the golden set. Injection cases belong in the eval harness, not in a one-off spreadsheet.
5. Log every tool call with the triggering span so you can audit after the fact.

What "good" looks like in review

A security team can name the data classes the agent sees, the writes it can perform, and the path for refusal. If you cannot print that on one page, you are not ready for production traffic, regardless of how fluent the answers are.

We include an injection and data-handling pass in the Claude Expert Audit. The output is a ranked list, not a slide titled "be careful with prompts."