Prompt injection is an architecture problem, too.

Simon Willison examines CaMeL, a research approach that separates planning from processing untrusted content and tracks how data reaches sensitive operations. The aim is to constrain what malicious instructions inside retrieved material can influence. It offers an architectural direction beyond simply asking the model to ignore suspicious text.

Simon Willison · Apr 11, 2025

Why it matters

Relevant to agents that read external pages or messages before deciding which tools to call.

More context

The useful design question is where untrusted content can become authority. Isolate external data from permissions and action selection, and make sensitive operations obey explicit policies. Read the linked research before assuming the approach transfers unchanged to your own agent.

Keep in mind

This is an analysis of a research proposal. It does not establish a universal solution to prompt injection.

Original read