OpenAI discusses agent defences against social engineering: limit possible impact as well as detecting malicious text
OpenAI says prompt injection is increasingly resembling social engineering, and classifying external content alone may be insufficient. Its defensive approach includes restricting high-risk agent actions so that even if manipulation partly succeeds, less data can be accessed or sent out.
Source Facts
On 11 March, OpenAI shared design approaches for agents resisting prompt injection. It notes that misleading content uses context and social engineering and is not necessarily limited to direct instructions telling a model to ignore its rules.
The article considers untrusted inputs alongside tool actions that may have consequences, such as sending data or following links. It recommends designing systems with reference to the permissions, limits and process controls people would have for comparable work.
Organisations can first define what agents may read, write and send, then assess content filtering effectiveness.
Original sources
Designing AI agents to resist prompt injection
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationLiteLLM explains package compromise: exposed keys must be revoked to complete the response
IllustrationSOCRadar examines SI agent-assisted extortion: human approval remains part of the intrusion process
Illustration