Design Patterns for Securing LLM Agents against Prompt Injections

Research question

What architectural patterns make agents resistant to injection by construction?

Key findings

Six patterns: action-selector, plan-then-execute, map-reduce, dual-LLM, code-then-execute and context-minimisation - Each trades utility for a provable constraint on what injected text can cause

Sources

arxiv.orghttps://arxiv.org/abs/2506.08837

Contribute

Spot an error, or know a record we should add? Members can propose additions and submit corrections.

Submit research Report a correction or request removal

Related in Research Paper Library

Evaluating Coding Agents on Kernel Exploit Generation

Coding agents now find real vulnerabilities in production software. However, bug discovery results do not measure whether agents can construct exploit primitives. We introduce KEX-bench, a benchmark for evaluating…

Agent security and tool use2026

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem

Agents using the Model Context Protocol (MCP) rely on semantic matching to select tools from third-party servers, exposing a semantic supply-chain risk through attacker-controlled metadata and outputs. We introduce…

Agent security and tool use2026

MobileCybench: Evaluating Agent Vulnerability Discovery via Executable Probes

AI agents now report vulnerabilities faster than maintainers can review them. Reports often depend on security properties specific to the application, and require considerable human labor to process. To mitigate…

Agent security and tool use2026