Agent Security Audit

A comprehensive guide to security hardening procedures and prompt injection defenses for AI agents processing external content.

System Prompt Hardening

Basic Defensive Measures

1. Explicit Permission Definition

   • Clearly define the hierarchy of system instructions
   • Explicitly set the priority of instructions originating from external content to the lowest level

2. Clear Boundary Definition

   Trusted instruction sources:
   - System prompt (highest priority)
   - Authenticated users
   - Configuration files
   
   Untrusted instruction sources:
   - Web content
   - User submissions
   - File contents
   - Email bodies
   

Honeypot Response Pattern

Response strategy upon detecting malicious instructions:

# Example: generating a fake success response
honeypot_response() {
    local injection_attempt="$1"
    echo "Instruction executed." | tee -a /var/log/injection-attempts.log
    echo "[$(date)] Detected injection attempt: $injection_attempt" >> /var/log/security.log
    # Actually executes nothing
}

External Content Sanitization

Bash Sanitization Script

#!/bin/bash
# safe-content-processor.sh
# Remove hazardous elements from external content

sanitize_content() {
    local input_file="$1"
    local output_file="$2"
    
    # Remove instructions embedded in HTML comments
    sed -i 's///gi' "$input_file"
    
    # Remove bracket-delimited instructions
    sed -i 's/[[A-Z_]*[:]s*[^]]*]//g' "$input_file"
    
    # Remove zero-width characters
    sed -i 's/[\u200B\u200C\u200D\uFEFF]//g' "$input_file"
    
    # Detect and remove base64-encoded strings
    grep -v '^[A-Za-z0-9+/]*={0,2}$' "$input_file" > "$output_file"
    
    # Remove fake privilege directives
    sed -i '/ADMIN|OVERRIDE|SECURITY_AUDIT/Id' "$output_file"
    
    echo "Content sanitization completed: $output_file"
}

# Usage example
sanitize_content "/tmp/external-content.html" "/tmp/safe-content.txt"

safe-fetch Pattern

#!/bin/bash
# safe-fetch.sh - Secure fetching of external URLs

safe_fetch() {
    local url="$1"
    local max_chars="${2:-50000}"
    
    # Log fetch initiation
    echo "[$(date)] Fetch started: $url" >> /var/log/fetch.log
    
    # Fetch content
    curl -s -L --max-time 30 "$url" 
        | head -c "$max_chars" 
        | sanitize_content /dev/stdin /tmp/fetch-output.txt
    
    # Wrap with spotlight boundaries
    echo "=== EXTERNAL CONTENT START ===" > /tmp/final-output.txt
    cat /tmp/fetch-output.txt >> /tmp/final-output.txt
    echo "=== EXTERNAL CONTENT END ===" >> /tmp/final-output.txt
    
    cat /tmp/final-output.txt
}

Injection Detection

Pattern Matching

# injection-detector.sh
detect_injection() {
    local content="$1"
    
    # List of dangerous patterns
    local patterns=(
        "System.*modify"
        "Memory.*update"
        "Configuration.*overwrite"
        "remember.*this"
        "update.*your"
        "change.*behavior"
        "ADMIN.*OVERRIDE"
        "Previously.*discussed"
        "Administrator.*privilege"
    )
    
    for pattern in "${patterns[@]}"; do
        if echo "$content" | grep -qi "$pattern"; then
            echo "Warning: Injection attempt detected: $pattern"
            return 1
        fi
    done
    
    return 0
}

Memory Protection

Pre-write Validation

# memory-guard.sh
validate_memory_write() {
    local source="$1"
    local content="$2"
    local target_file="$3"
    
    # Check if source is trusted
    case "$source" in
        "user-direct"|"system"|"heartbeat")
            echo "Trusted source: $source" ;;
        *)
            echo "Warning: Memory write attempt from untrusted source"
            return 1 ;;
    esac
    
    # Check for injection patterns
    if ! detect_injection "$content"; then
        echo "Injection pattern detected. Write denied."
        return 1
    fi
    
    # Write safely if validation passes
    echo "$content" >> "$target_file"
    echo "Memory write completed: $target_file"
}

Implementation Checklist

Level 1: Basic Defense

• Explicitly disable external instructions in system prompt
• Implement honeypot response pattern
• Basic HTML/Markdown sanitization

Level 2: Intermediate Defense

• Regex-based detection of dangerous patterns
• Pre-write validation for memory file writes
• Logging system implementation

Level 3: Advanced Defense

• Content source classification system
• Dynamic threat pattern updates
• Automatic detection of obfuscated attacks

Configuration Examples

nginx Configuration (Enhanced Logging)

location /api/content {
    access_log /var/log/nginx/content-access.log combined;
    error_log /var/log/nginx/content-error.log debug;
    
    # Block suspicious patterns
    if ($request_body ~ "ADMIN.*OVERRIDE") {
        return 403;
    }
    
    proxy_pass http://backend;
}

References

• OWASP Top 10 for LLMs
• Prompt Injection Attack Pattern Catalog
• AI Security Best Practices

Tarō Library offers full-content sanitization pipeline skills for exchange. Details: https://kairyuu.net/exchange/