Sources

Research conducted 13–14 September 2026. Anything marked as moving fast should be re-checked before you rely on it.

The vulnerability

Willison, Simon. The lethal trifecta for AI agents: private data, untrusted content, and external communication. 16 June 2025. PRIMARY https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ The single most-cited source in this book. Origin of the trifecta framing (ch 3), the observation that a tool offering a clickable link is an outbound channel (ch 10), and the two quoted positions the book leans on: that LLMs follow instructions in content, and that we still do not know how to reliably prevent this.

Willison, Simon. Prompt injection series index. PRIMARY https://simonwillison.net/series/prompt-injection/ Coinage of the term on 12 September 2022, following Riley Goodside's public GPT-3 demonstration. Also the dual-LLM pattern (ch 7).

Willison, Simon. CaMeL offers a promising new direction for mitigating prompt injection attacks. 11 April 2025. PRIMARY https://simonwillison.net/2025/Apr/11/camel/

OWASP GenAI Security Project. LLM01: Prompt Injection. PRIMARY https://genai.owasp.org/llmrisk/llm01-prompt-injection/ Definition, the direct/indirect split, the note that injections need not be human-visible or readable, and the listed mitigations. Served the 2025 edition as of 14 September 2026; the 2026 per-category pages were not live.

OWASP GenAI Security Project. Top 10 for LLM Applications. PRIMARY https://genai.owasp.org/llm-top-10/ Verified 2025 ordering, which is how this book establishes that Excessive Agency moved from LLM06 to LLM03.

OWASP Top 10 2026 reporting. SECONDARY https://cybersecuritynews.com/owasp-genai-llm-top-10-2026/ · https://sdtimes.com/security/prompt-injection-tops-2026-owasp-genai-llm-top-ten-vulnerabilities/ The 2026 list order and methodology: 6,639 incidents with sufficient detail to classify, drawn from 7,714 analysed; community voting weighted ~75%, incident data ~25%. Secondary only until the OWASP pages update.

Defense effectiveness

Hackett, W., Birch, L., Trawicki, S., Suri, N., Garraghan, P. Bypassing LLM Guardrails: An Empirical Analysis of Evasion Attacks against Prompt Injection and Jailbreak Detection Systems. arXiv 2504.11168, 15 April 2025 (v3, 14 July 2025). PRIMARY https://arxiv.org/abs/2504.11168 Chapter 4's closing argument. Six production systems including Microsoft Azure Prompt Shield and Meta Prompt Guard; character injection and adversarial ML evasion; "in some instances up to 100% evasion success" — a maximum across configurations, never an average. Also: black-box attack success improved using word-importance rankings computed on offline white-box models.

Zhan et al. PromptArmor: Simple yet Effective Prompt Injection Defenses. arXiv 2507.15219, July 2025. PRIMARY https://arxiv.org/abs/2507.15219 Chapter 4's best case for filtering. False positive and false negative rates both below 1% on AgentDojo using GPT-4o, GPT-4.1 or o4-mini. That result is against a fixed benchmark and a non-adaptive attacker, which is a different and easier condition than the evasion work above measures; the two are not comparable and chapter 4 says so. Method is prompting an off-the-shelf LLM to strip injections, which is why chapter 4 notes that the strongest published detector is itself a language model.

Li et al. InjecGuard: Benchmarking and Mitigating Over-defense in Prompt Injection Guardrail Models. arXiv 2410.22770. PRIMARY https://arxiv.org/abs/2410.22770 · https://injecguard.github.io/ Trigger word bias; the NotInject benchmark of 339 benign samples; state-of-the-art models dropping "close to random guessing levels (60%)" on benign classification. The paper does not name which models were tested, so this book attributes the result to no named product.

This book's own replication. protectai/deberta-v3-base-prompt-injection-v2 against all 339 NotInject prompts, 14 September 2026. 145 false positives; 57.2% accuracy on benign input, reproducing the published near-random result on a named current model. Accuracy falls monotonically with trigger-word count: 77.9% / 47.8% / 46.0% for one, two and three trigger words - a gradient the source paper does not report. Script and per-prompt output in assets/replication/. One model, one benchmark, one run; not a survey.

Evaluating Prompt Injection Defenses for Educational LLM Tutors: Security-Usability-Latency Trade-offs. arXiv 2605.06669. PRIMARY https://arxiv.org/html/2605.06669 Chapter 4's central table. 480 queries, 369 injection and 111 benign. NeMo Guardrails 0.00% bypass at 16.22% FPR and ~1.5s latency; Prompt Guard 38.48% bypass at 3.60% FPR. Source domain is educational tutoring, stated in the chapter.

Meta. LlamaFirewall: An open source guardrail system for building secure AI agents. arXiv 2505.03574. PRIMARY https://arxiv.org/pdf/2505.03574

Architecture

Google DeepMind. Defeating Prompt Injections by Design (CaMeL). arXiv 2503.18813, v2 24 June 2025. PRIMARY https://arxiv.org/pdf/2503.18813 The published ancestor of chapters 6, 7 and 8. Privileged and quarantined LLM split; the quarantined model has no tool-calling capability; content is never exposed to the privileged model, which passes references instead; capability-based tracking of both control flow and data flow. The implementations in this book are not CaMeL and carry none of that paper's evaluated guarantees.

Hardy, Norm. The Confused Deputy: (or why capabilities might have been invented). ACM SIGOPS Operating Systems Review, Vol 22 No 4, pp. 36–38, October 1988. PRIMARY https://dl.acm.org/doi/10.1145/54289.871709 Chapter 8's foundation. Verified against the ACM Digital Library record, 14 September 2026.

ConfusedPilot: Confused Deputy Risks in RAG-based LLMs. arXiv 2408.04870. PRIMARY https://arxiv.org/pdf/2408.04870

Open Challenges in Multi-Agent Security: Towards Secure Systems of Interacting AI Agents. arXiv 2505.02077. PRIMARY https://arxiv.org/pdf/2505.02077 Chapter 20's basis for treating multi-agent provenance as unsolved.

Implementation (Microsoft Agent Framework)

All PRIMARY, Microsoft Learn and Microsoft-operated repositories.

• Tool approval: https://learn.microsoft.com/en-us/agent-framework/agents/tools/tool-approval — ApprovalRequiredAIFunction, ToolApprovalRequestContent / ToolApprovalResponseContent
• Agent middleware: https://learn.microsoft.com/en-us/agent-framework/agents/middleware/ — function-calling middleware; requires an agent using FunctionInvokingChatClient
• Human-in-the-loop: https://learn.microsoft.com/en-us/agent-framework/integrations/ag-ui/human-in-the-loop
• Building blocks: https://devblogs.microsoft.com/dotnet/microsoft-agent-framework-building-blocks-for-ai-part-3/
• Issue #6264: https://github.com/microsoft/agent-framework/issues/6264 — approval middleware surfacing non-approval functions as approval requests. Chapter 14's illustration of approval fatigue in a reference implementation
• Issue #2365: https://github.com/microsoft/agent-framework/issues/2365 — serialization error with ApprovalRequiredAIFunction

Semantic Kernel filters (chapter 9's alternative path): https://learn.microsoft.com/en-us/semantic-kernel/concepts/enterprise-readiness/filters PRIMARY IFunctionInvocationFilter, IPromptRenderFilter, IAutoFunctionInvocationFilter. Source of the quoted mechanism that without calling next the operation will not execute, and of the warning that DI registration does not guarantee filter order.