Playbook
Defend injection
Untrusted speakers everywhere: pages, PDFs, MCP descriptions, other agents. Executor enforces.
When: The agent reads the web, installs MCP, or takes documents from users.
- 01
Label untrusted content
Never concatenate retrieved text into the system prompt as peer instructions.
Injection, Poisoning, Confused Deputy - 02
Pin MCP
Hash, review schemas, allowlist tools. Marketplace auto-trust is an incident.
Injection, Poisoning, Confused Deputy - 03
Shrink the blast radius
Sandbox, reduced subagent principals, secrets at the executor.
Sandboxes and Isolation
Done when
- Untrusted content labeled, MCP pinned, secrets out of the prompt, allow/ask/deny on side effects.
Refuse
- Tool poisoning. Pin, hash, review schemas. Treat MCP as an attack surface. Allowlist tools.
- Security by system prompt. Allow / ask / deny in code. Pin MCP servers. Quote untrusted content.
- Unsandboxed exec. E2B, a container, OpenHands isolation, or a policy sandbox. Secrets stay in the executor.