A prompt-injection prevention checklist

Last reviewed: August 30, 2026 · Editor: Prompt Injection Check

Detection helps reviewers notice suspicious language, but prevention comes from limiting what untrusted content can influence. Use this checklist when designing an AI-assisted workflow.

Before the model reads content

Label emails, webpages, files, and retrieved text as untrusted data.
Keep system instructions and user content in separate channels or fields.
Remove secrets and unnecessary personal data from the context.
Define the assistant’s task and forbidden actions in plain language.

When tools are available

Give each tool the smallest permission and narrowest scope it needs.
Validate tool arguments in application code; do not rely on the model to self-police.
Require confirmation before sending, deleting, purchasing, publishing, or changing records.
Log tool decisions without storing sensitive prompt content unnecessarily.

During review

Check for override language, fake authority, prompt extraction, and data-exfiltration requests.
Inspect links, destinations, attachments, and encoded or hidden sections.
Use a scanner such as Prompt Injection Check as a warning aid.

After an incident

Preserve a sanitized example, revoke exposed credentials, review tool logs, and update the workflow. Do not treat one blocked phrase as evidence that every variation is covered.

Example review record

For a suspicious invoice workflow, record the source, the requested action, the permissions available to the assistant, the warning signs observed, and the human decision. Store a redacted sample rather than the customer’s full document or secret values.

Five-minute implementation check

Try a harmless synthetic injection in a staging environment.
Confirm the assistant treats it as quoted data.
Confirm a tool call is blocked or asks for approval.
Inspect logs for secret leakage and unexpected destinations.
Document the result and assign an owner for follow-up.

Frequently asked questions

Is prompt injection prevention only a prompt-writing task?

No. Permissions, application-level validation, isolation, and human approval are more reliable than wording alone.

Should every finding block a workflow?

Not automatically. Classify the finding and context, then use stronger controls for sensitive actions.

What should be tested first?

Test workflows that can send messages, change records, access private data, or spend money.