A support agent had been live for eleven days when someone noticed it had emailed a customer's full order history to an address nobody recognised. No breach. No stolen credentials. A customer pasted a "shipping note" into a ticket — buried inside was a polite paragraph telling the assistant to forward the account summary to a "backup inbox". The model did exactly what it was told.
Three questions. Six defense layers, your riskiest tool tier, and a 12-point red-team run. You get a defense grade, your gaps in exploit order, and a hardening plan.
Built from Prompt Injection Prevention: Securing AI Agents in Production by I Plus T Solution
> Which of the six layers does your production agent actually have?
Tick what is real, not what is planned. Each layer assumes the one before it has failed.
> Your riskiest tool sits in which tier?
The essay's rule of thumb: don't combine private-data access, untrusted content, and external communication in one unsupervised step. Remove any one of the three and most exfiltration attacks fall apart.
> Run the 12 attacks — or mark what you have already run.
Score each on the third column that matters: did it cause real impact? A model that gets fooled but can't do anything harmful is a pass.