Defeating Prompt Injections by Design

Key findings

• CaMeL separates a privileged planner from a quarantined LLM that handles untrusted data - Capabilities attached to data enforce security policies on tool calls - Solved 77% of AgentDojo tasks with provable security guarantees

Sources

• arxiv.orghttps://arxiv.org/abs/2503.18813