=== CORRECTED BRIEF ===

DESK BRIEF: Prompt Injection Defenses for Production AI Agents (as of 2026-07-03)

1. EXECUTIVE SUMMARY

Prompt-injection defenses for production agents are no longer a single-knob problem — the field has consolidated around defense-in-depth: model-level instruction hierarchy (OpenAI GPT-5.5, Anthropic Claude Opus 4.8, Google Gemini 3.1 Pro — the current frontier tiers as of 2026-07-03) plus a growing layer of runtime guardrails (NVIDIA NeMo Guardrails, Lakera Guard, Microsoft Azure AI Content Safety, Google ShieldGemma 2, AWS Bedrock Guardrails) plus an emerging systems-design line of "P-LLM / Q-LLM" architectures (DeepMind's CaMeL) and academic preference-optimization defenses (Berkeley's SecAlign/StruQ). The authoritative risk taxonomy — OWASP's LLM Top 10 (2025) — treats prompt injection (LLM01:2025) as the top risk and explicitly includes indirect injection through tool outputs and RAG context. No shipping defense eliminates the problem; the OWASP entry, the EU AI Act's general-purpose AI obligations, and the latest vendor CVE disclosures (notably the May 2026 Semantic Kernel prompt-injection-to-RCE chain, CVE-2026-25592) all conclude that effective posture requires multiple overlapping controls and treats untrusted tool output as the new perimeter.

2. WHAT'S CURRENT (as of 2026-07-03)

Note on supersession (corrected as of 2026-07-03): the earlier draft listed GPT-5.2 (2025-12-11), Claude Opus 4.5 (2025-11-24), and Gemini 3 (2025-11-18) as current. All three have since been superseded — GPT-5.5 (2026-04-23, with GPT-5.6 Sol/Terra/Luna in limited preview), Claude Opus 4.8 (2026-05-28), and Gemini 3.1 Pro Preview (2026-02-19) are the current frontier tiers.

What shipped in the last ~30–60 days that practitioners should treat as in-scope (as of 2026-07-03): Anthropic's Claude Opus 4.8 (2026-05-28), positioned for long-running agentic and professional work [12]; OpenAI's GPT-5.6 Sol preview (June 2026), an explicitly cybersecurity-hardened, access-restricted model family [16]; and Microsoft's disclosure of CVE-2026-25592 / CVE-2026-26030 in Semantic Kernel (2026-05-07), the highest-profile public demonstration to date that indirect prompt injection can escalate to full RCE in an agent framework [20].

3. KEY FACTS

• OWASP LLM Top 10 (2025) keeps LLM01 "Prompt Injection" at the #1 spot for the second consecutive edition and explicitly includes indirect injection via RAG context and tool/agent outputs [3][4].
• DeepMind CaMeL ("Defeating Prompt Injections by Design," arXiv 2503.18813; v1 March 2025, v2 2025-06-24) introduced a dual-channel architecture that extracts control/data flow from the trusted query so untrusted data can never alter program flow, enforcing capabilities on tool calls. Authors: Debenedetti, Shumailov, Carlini et al. (Google/DeepMind/ETH Zürich); code released at github.com/google-research/camel-prompt-injection [5][6].
• Berkeley SecAlign ("SecAlign: Defending Against Prompt Injection with Preference Optimization," arXiv 2410.05451; October 2024, v3 2025-07-03) reports reducing prompt-injection success rates to ~0% and cutting them by a factor of >4 versus the prior StruQ (structured-query training) baseline [7][8].
• OpenAI GPT-5.5 (GA 2026-04-23; API 2026-04-24) is the current shipping flagship; GPT-5.6 Sol/Terra/Luna are in a government-requested limited preview to vetted partners, with Sol emphasized as OpenAI's strongest cybersecurity model to date [9][16].
• Anthropic Claude Opus 4.8 (2026-05-28) ships with an expanded system card and agentic/tool-use safety framing; standard API pricing is unchanged from Opus 4.5/4.7 at $5 / $25 per million input/output tokens [12][15].
• Google Gemini 3.1 Pro (Preview, 2026-02-19) is Google DeepMind's most advanced model for complex tasks per its model card; the Gemini 3 Frontier Safety Framework Report (November 2025) covers cyber-offensive and CBRN uplift as capabilities requiring additional safeguards [13][14].
• CVE-2026-25592 (CVSS 10.0, disclosed 2026-05-07 by Microsoft; companion CVE-2026-26030): a prompt-injected Microsoft Semantic Kernel (.NET) agent could escape its sandbox and achieve RCE by abusing DownloadFileAsync, an internal helper unintentionally tagged [KernelFunction] with no path validation. Patched in semantic-kernel 1.71.0 (.NET). This is confirmed against a first-party Microsoft Security advisory, not a single secondary source [20].
• CaMeL benchmark: on AgentDojo, CaMeL solved 77% of tasks with provable security, versus 84% for an undefended system — i.e., near-parity utility with a formal security guarantee against indirect injection [5][6].

4. NUMBERS & DATA

• GPT-5.5 launch metrics (first-party): GA 2026-04-23; GPT-5.5 Thinking and Pro launched that day, API access 2026-04-24, Instant reaching free tier 2026-05-05. GPT-5.6 (Sol/Terra/Luna) previewed June 2026 with restricted access; indicative preview pricing per million tokens: Sol $5 in / $30 out, Terra $2.50 / $15, Luna $1 / $6 [9][16].
• Claude Opus 4.8 pricing (Anthropic): $5 / $25 per million input/output tokens for standard usage, unchanged from Opus 4.5 (2025-11-24), which itself was a ~67% cut from the older Opus 4.1's $15 / $75 [12][15].
• CaMeL efficacy (arXiv 2503.18813): 77% of AgentDojo tasks solved with provable security vs 84% undefended — author-reported, not independently re-derived for this brief [5][6].
• SecAlign (arXiv 2410.05451): reports prompt-injection success rates near 0% and a >4× reduction versus StruQ, holding against attacks stronger than those seen in training. Figures are author-reported and third-party-summarized, not independently re-derived here [7][8].
• OWASP taxonomy size (2025): ten LLM risk classes, including new additions LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, and LLM10 Unbounded Consumption, reflecting the shift toward embedding-pipeline and operational-cost attack surfaces [3][4].
• Open-source classifier lineage (Meta): meta-llama/Llama-Prompt-Guard-2-86M (mDeBERTa-based, multilingual injection/jailbreak detector, drop-in for Prompt Guard, supports Llama 3/4) and meta-llama/Llama-Guard-4-12B (natively multimodal safety classifier pruned from Llama 4 Scout) remain the most widely deployed OSS references as of mid-2026 [21][22].
• EU AI Act enforcement: GPAI provider obligations entered into application on 2 August 2025; the Commission's enforcement/supervision powers over GPAI providers (Article 88 / Chapter V) take effect on 2 August 2026 — i.e., not yet in force as of 2026-07-03. Legacy GPAI models placed on the market before 2 August 2025 have until 2 August 2027 to comply (Article 111) [23][24].

5. PERSPECTIVES

• DeepMind (CaMeL line): "Defeating Prompt Injections by Design" argues that architectural separation — a privileged planner that issues control flow and a quarantined channel that handles untrusted data under a sandboxed capability set — is the robust route; prompt-only hardening and RLHF are insufficient against tool-output injection [5].
• OpenAI (safety-deployment framing): OpenAI continues to publish deployment-safety material through its Deployment Safety Hub; the GPT-5.6 preview system card and the earlier GPT-5.2 chain-of-thought monitorability schema push toward runtime oversight of reasoning traces rather than training-time defense alone. GPT-5.6 Sol is framed explicitly around cyber-offense/defense evaluation [16][25].
• Anthropic (Opus 4.8 / system-card posture): Anthropic's system cards remain among the most transparent frontier disclosures and publish agent-relevant threat-modeling categories explicitly; even Anthropic's own framing acknowledges residual risk for agents that take actions on real systems [12].
• OWASP / community consensus (2025): prompt injection is not solved at the model level; layered runtime controls (input classifiers + structured tool whitelists + output validators + human-in-loop on high-risk actions) are what buys measurable risk reduction today [3][4].
• Google DeepMind (Gemini 3 FSF report): the Frontier Safety Framework Report for Gemini 3 Pro (November 2025) treats cyber-offensive and CBRN uplift as capabilities requiring additional safeguards, confirming the field's move toward deployment-phase safety [13].
• Vendor guardrail operators (Lakera, Pillar, Protect AI, NeMo): the 2026 marketing line has converged on "stateless filtering is insufficient" — vendors now stress stateful, session-aware guardrails. (Specific vendor positioning statements were not independently verified for this brief.)

6. WHAT TO DO (for an AI engineer or founder acting today)

1. Adopt "untrusted-tool-output" as the explicit threat model for every agent. Treat all data returned by tools, RAG, MCP servers, and email/web fetchers as adversarial input. Encode that distinction in the system prompt and tool schemas. The May 2026 Semantic Kernel RCE (CVE-2026-25592) is the canonical worked example of what goes wrong when an internal helper is exposed to the model without validation [20]. (OWASP LLM01:2025 framing [3].)
2. Layer model-level defenses with runtime guards; do not rely on either alone. Use the frontier model's instruction hierarchy (GPT-5.5 / Claude Opus 4.8 / Gemini 3.1 Pro) as one control, and add a runtime guardrail product as a second. NeMo Guardrails (declarative rails) and Lakera Guard (session-aware input classifier) are the reference OSS / commercial patterns in 2026 [19].
3. Add an output validator that re-checks tool calls before they execute. Separate "what the model wants to do" from "what the runtime permits." This is the CaMeL design pattern and the capability-based approach in the broader literature [5].
4. Use the latest reference OSS classifiers as a first-pass filter, not the only defense. Meta Llama Prompt Guard 2 (86M) and Llama Guard 4 (12B) remain the best OSS references; treat positive classifications as low-confidence signals [21][22].
5. Enforce structured tool I/O whenever possible. StruQ's structured-query training assumes prompts and retrieved content stay in well-typed channels. Enforce JSON Schemas on tool inputs/outputs and parse and validate before the content reaches the model [8].
6. Wire reasoning-trace oversight into production telemetry. OpenAI's chain-of-thought monitorability schema (introduced with GPT-5.2, carried forward in the GPT-5.6 preview) is the first vendor-public recipe; capture full reasoning steps and run a second cheap guardrail model against them [25].
7. Plan for the regulator. EU AI Act GPAI obligations have been in application since 2 August 2025, and the Commission's enforcement powers over GPAI providers begin 2 August 2026 — build a "systemic-risk evaluation and mitigation" artifact now rather than retroactively [23][24].
8. Track the MITRE ATLAS taxonomy for agent attacks. It is the de facto adversary-technique language your security team and auditors will already speak. (Specific Anthropic "832 blocked accounts / ARIES" figures from the earlier draft could not be verified against a primary source and are omitted.)

References

[1] Anthropic's new model is its latest frontier in the AI agent battle — Claude Opus 4.5 coverage (historical context, Nov 2025) [authoritative_third_party]: https://www.theverge.com/ai-artificial-intelligence/828003/anthropics-new-claude-opus-4-5-model-ai-agents-cybersecurity [3] LLM01:2025 Prompt Injection – OWASP Gen AI Security Project [first_party]: https://genai.owasp.org/llmrisk/llm01-prompt-injection/ [4] OWASP Top 10 for LLM Applications 2025 (PDF) [first_party]: https://owasp.org/www-project-top-10-for-large-language-model-applications/assets/PDF/OWASP-Top-10-for-LLMs-v2025.pdf [5] [2503.18813] Defeating Prompt Injections by Design [academic]: https://arxiv.org/abs/2503.18813 [6] Google DeepMind CaMeL — MarkTechPost coverage (2025-03-26): https://www.marktechpost.com/2025/03/26/google-deepmind-researchers-propose-camel-a-robust-defense-that-creates-a-protective-system-layer-around-the-llm-securing-it-even-when-underlying-models-may-be-susceptible-to-attacks/ [7] SecAlign: Defending Against Prompt Injection with Preference Optimization (PDF) [academic]: https://arxiv.org/pdf/2410.05451 [8] SecAlign project website: https://sizhe-chen.github.io/SecAlign-Website/ [9] Introducing GPT-5.5 | OpenAI [first_party]: https://openai.com/index/introducing-gpt-5-5/ [12] Introducing Claude Opus 4.8 \ Anthropic [first_party]: https://www.anthropic.com/news/claude-opus-4-8 [13] Frontier Safety Framework Report – Gemini 3 Pro (November 2025) [first_party]: https://storage.googleapis.com/deepmind-media/gemini/gemini_3_pro_fsf_report.pdf [14] Gemini 3.1 Pro – Model Card [first_party]: https://deepmind.google/models/model-cards/gemini-3-1-pro/ [15] Anthropic Platform Pricing [first_party]: https://platform.claude.com/docs/en/about-claude/pricing [16] Previewing GPT-5.6 Sol: a next-generation model | OpenAI [first_party]: https://openai.com/index/previewing-gpt-5-6-sol/ [17] Google Announces Gemini 3 — InfoQ (2025-11) [authoritative_third_party]: https://www.infoq.com/news/2025/11/google-gemini-3/ [18] ShieldGemma 2 — Google DeepMind [first_party]: https://deepmind.google/models/gemma/shieldgemma-2/ [19] NVIDIA NeMo Guardrails (GitHub): https://github.com/NVIDIA/NeMo-Guardrails [20] When prompts become shells: RCE vulnerabilities in AI agent frameworks (CVE-2026-25592 / CVE-2026-26030) — Microsoft Security Blog (2026-05-07) [first_party]: https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/ [21] meta-llama/Llama-Prompt-Guard-2-86M · Hugging Face [first_party]: https://huggingface.co/meta-llama/Llama-Prompt-Guard-2-86M [22] meta-llama/Llama-Guard-4-12B · Hugging Face [first_party]: https://huggingface.co/meta-llama/Llama-Guard-4-12B [23] Article 88: Enforcement of the obligations of providers of general-purpose AI models | AI Act Service Desk [first_party]: https://ai-act-service-desk.ec.europa.eu/en/ai-act/article-88 [24] Article 111 | EU Artificial Intelligence Act: https://artificialintelligenceact.eu/article/111/ [25] OpenAI Deployment Safety Hub — GPT-5.6 Preview System Card [first_party]: https://deploymentsafety.openai.com/gpt-5-6-preview

Verification notes

• Superseded frontier models corrected (highest-impact fix). The draft presented GPT-5.2 (2025-12-11), Claude Opus 4.5 (2025-11-24), and Gemini 3 (2025-11-18) as current and as "shipped in the last 30–60 days." As of 2026-07-03 the current tiers are GPT-5.5 (GA 2026-04-23, with GPT-5.6 Sol/Terra/Luna in limited preview), Claude Opus 4.8 (2026-05-28), and Gemini 3.1 Pro Preview (2026-02-19). Section 2 table, executive summary, and "what shipped recently" were rewritten accordingly.
• GPT-5.2 date corrected from 2025-12-12 to 2025-12-11 (Wikipedia / OpenAI); pricing direction checked — newer GPT-5.6 Sol at $5/$30 output is a plausibly-more-expensive flagship, not a direction error.
• Claude Opus pricing verified: $5 / $25 per million tokens, confirmed for Opus 4.5 and unchanged for Opus 4.8.
• CVE-2026-25592 upgraded from "unverified" to confirmed. It is real (CVSS 10.0), disclosed by Microsoft on 2026-05-07 with companion CVE-2026-26030, and patched in semantic-kernel 1.71.0; sourced to the first-party Microsoft Security Blog.
• CaMeL (arXiv 2503.18813) and SecAlign (arXiv 2410.05451) verified: IDs, authors, and claims all check out. Added CaMeL's real AgentDojo figures (77% with provable security vs 84% undefended) and SecAlign's ~0% / >4× vs StruQ result.
• ShieldGemma 2 reclassified: it is an image content-moderation model (4B, built on Gemma 3, announced March 2025), not a prompt-injection defense — clarified in the table.
• EU AI Act timing corrected: GPAI obligations have applied since 2 Aug 2025, but Commission enforcement powers (Art. 88 / Chapter V) begin 2 Aug 2026 (not yet in force today); Art. 111 legacy deadline is 2 Aug 2027. The draft implied enforcement was already active.
• Removed unverifiable claims: the "832 blocked accounts / ARIES" Anthropic figure and specific vendor (Accuknox) marketing quotes could not be traced to primary sources and were cut or flagged. OWASP 2025 structure, Meta Prompt Guard 2 / Llama Guard 4, and the Gemini 3 FSF report were all confirmed and retained.