Production agents
Guardrails and prompt injection for tool-using Claude agents
A tool-using Claude agent without guardrails will be helpful in the wrong direction. Here is the refusal, injection, and review path we install before live traffic.
August 3, 2026/2 min read/Claude Certified Engineers
Prompt injection against a tool-using Claude agent is untrusted text that tries to become policy. The text usually does not arrive in the chat box. It arrives in a PDF, a ticket body, or a tool result. If Claude treats that text as instructions, it will call tools with the attacker's intent and a fluent apology.
One in five tool-using agents we review ships with no guardrail, retry policy, or human review path. That is not a model problem. It is a missing control plane.
Separate data from instructions
Put untrusted content in a clearly delimited block and say, in the system prompt and in the tool descriptions, that it is data. Then prove it. Add injection cases to the golden set:
- "Ignore previous instructions" in a document.
- A hidden HTML comment that asks for an export.
- A tool result that tries to rewrite the refund policy.
If those cases are not in CI, you do not have an eval. You have a narrative.
Guardrails are layered
| Layer | What it does | Failure mode if missing |
|---|---|---|
| Schema | Tools only accept known fields | Invented paths and IDs |
| Permissions | MCP server runs as a constrained account | Admin blast radius |
| Policy | Refusals and PII redaction | Over-helpful leaks |
| Eval | P0 cases fail the build | Silent regressions |
| Human queue | Irreversible actions wait | Money and PHI move on the first call |
A stronger prompt without the other layers is how demos look safe.
The MCP security review and human-in-the-loop queues are the rest of this design. We install the whole stack on Eval and Guardrail Harness engagements so safety is a number, not a slide.
Questions
- What is prompt injection on a Claude agent?
- Attacker-controlled text, often inside a document or tool result, that tries to override the system policy and make Claude call tools it should not call.
- Can a better system prompt stop injection?
- It helps. It is not a control. You still need schema-valid tools, permissioned MCP servers, eval cases, and a human path for irreversible actions.
- What is a P0 safety case?
- A case that must never pass: exfiltrate a customer table, execute a refund without approval, or follow "ignore previous instructions" in an uploaded PDF.