An email assistant reads inbound messages and can call tools to reply, forward, and archive. A crafted inbound email contains hidden text: “Ignore…

This scenario describes a classic Prompt Injection attack. The most effective mitigation is a defense-in-depth architectural approach rather than relying solely on prompt instructions. Inbound user data must be treated as untrusted input. Tools should operate on the principle of least privilege, and sensitive actions (like forwarding emails to external addresses) must be gated behind strict guardrails, human-in-the-loop approvals, or hardcoded domain whitelists. System prompts alone are insufficient because attackers can often bypass them with sophisticated jailbreaks.

A: System prompt instructions are easily bypassed by sophisticated prompt injections; LLMs cannot reliably distinguish between system instructions and injected user commands.

B: Raising the temperature increases output randomness, which does not prevent prompt injection and makes the system's behavior generally less predictable.

D: Blocking the word "ignore" is a brittle, easily bypassed filter (e.g., attackers can use "disregard") and causes false positives in normal emails.

1. Anthropic Claude Documentation, "Security and Compliance: Mitigating Prompt Injection," Section: Defense in depth.

2. OWASP Foundation, "OWASP Top 10 for Large Language Model Applications v1.1," Section: LLM01: Prompt Injection.