HackerPapers

arXiv:2506.08837cs.LG

Design Patterns for Securing LLM Agents against Prompt Injections

Luca Beurer-Kellner, Beat Buesser, Ana-Maria Creţu, Edoardo Debenedetti, Daniel Dobos, Daniel Fabian, Marc Fischer, David Froelicher, Kathrin Grosse, Daniel Naeff, Ezinwanne Ozoani, Andrew Paverd, Florian Tramèr, Václav Volhejn

Abstract

As AI agents powered by Large Language Models (LLMs) become increasingly versatile and capable of addressing a broad spectrum of tasks, ensuring their security has become a critical challenge. Among the most pressing threats are prompt injection attacks, which exploit the agent's resilience on natural language inputs -- an especially dangerous threat when agents are granted tool access or handle sensitive information. In this work, we propose a set of principled design patterns for building AI agents with provable resistance to prompt injection. We systematically analyze these patterns, discuss their trade-offs in terms of utility and security, and illustrate their real-world applicability through a series of case studies.

arXiv comments
Journal reference
DOI
Subjects
cs.LGMachine Learning cs.CRCryptography and Security

On Hacker News

Linked by 5 identifiable commenters in 5 comments across 5 threads, from Jun 2025 to Jul 2026. Found in 4 HN submissions from Jul 2025 to Aug 2025. Open submission discussions.

Comments linking this paper, per year.

Discussed in comments5 threads

  1. Leaking YouTube creators' private videos 1 comment

    • You can get rid of 99.9% of those attacks by simply dispatching the data consumption to a different instance of the LLM, see, for instance, some of the later patterns in https://arxiv.org/abs/2506.08837

      mattalexView on HNParent context

  2. Launch HN: Slashy (YC S25) – AI that connects to apps and does tasks 1 comment

    • That’s a pretty scary answer, to be honest. Regardless, here’s the CaMeL paper. Defeating Prompt Injections by Design (2025): https://arxiv.org/abs/2503.18813 Here’s a paper offering a survey of different mitigation techniques, including CaMeL. Design Patterns for Securing LLM…

      amonksView on HNParent context

  3. My Lethal Trifecta talk at the Bay Area AI Security Meetup 1 comment

    • I believe you've covered some working solutions in your presentation. They limit LLMs to providing information/summaries and taking tightly curated actions. There are currently no fully general solutions to data exfiltration, so things like local agents or computer…

      benlivengoodView on HNParent context

  4. Supabase MCP can leak your entire SQL database 1 comment

    • There's a crucial difference here. When you were working as a pentester, how often did you find a security hole and report it and the response was "it is impossible for us to fix that hole"? If you find an XSS or a SQL injection, that means someone made a mistake and the mistake…

      simonwView on HNParent context

  5. Design Patterns for Securing LLM Agents Against Prompt Injections 1 comment

Submitted to Hacker News

Connected through shared HN threads, not inferred similarity or a recommendation.