Prompt injection: sources and the three-property gate
Explains where uncontrolled text enters a Duale AI Task and the three-property gate that determines when to add a check before an external action.
This page covers untrusted text sources, the three-property gate for external actions, risk-reduction strategies, and Duale AI's enforced bounds.
- Sources of untrusted text entering a Task.
- The three-property gate for external actions.
- Strategies to remove one property and reduce risk.
- Duale AI enforced bounds on Tasks and resources.
Summaries were generated by AI.
A Task can read text you do not control that tries to steer its work. Identify where that text enters, which boundaries Duale AI enforces, and which controls your application must add.
Where text you do not control enters
Each source below can reach the model as ordinary text when the Task uses it. You wrote none of it at the moment the model reads it.
An MCP Tool definition reaches the model before any Tool Call. Its name, title, description, Source context, and input schema can influence Tool selection and proposed arguments. Tool Results and the other sources above can enter the Task history and influence later model turns. Text that steers the model early in a Task can therefore keep steering it until the Task ends. Text that one user wrote can also reach a later Task of the same Agent Identity, including a Task for another user.
Prompt injection remains possible
Duale AI does not identify and remove embedded instructions before it gives extracted text to the model. Extraction can change the format or omit content; it is not a security filter.
Current language models do not enforce a security boundary between instructions and data. The UK NCSC article Prompt injection is not SQL injection recommends deterministic safeguards that constrain actions and reduce the remaining risk and impact. OWASP Top 10 for LLM Applications 2025 lists prompt injection as LLM01.
One rule follows:
Treat every retrieved passage, search extract, fetched page, remote Tool definition, remote Tool Result, and earlier Task as content you do not control. Put deterministic controls in your SDK Tool, the remote system, or a separate authorized process.
A system instruction saying “do not delete records” is a preference. A check in the system that owns deletion is a control. If you cannot add that control to a remote MCP server, expose the protected operation through an SDK Tool or a separate acting process. Secure integration shows the pattern.
Duale AI publishes no measured prompt-injection resistance rate. Your assessment must also cover the model providers you select, the SDK Tools you write, the MCP servers you configure, and every external service those Tools call.
Three properties together trigger this gate
Prompt injection can alter an answer even without sensitive-data access or an external action. Ask the three questions below about the Tasks of one Agent Identity, with the Tools and access they can use. Together they identify when to put a human decision or deterministic check before an external action:
- Do they read content you do not control?
- Can they reach data that matters?
- Can they change something outside Duale AI, or send a message?
When one Agent Identity serves several users, its Tasks always have the first property, because they can read earlier Tasks of other users.
Code Execution can add the first and the third property. The output of a program the model wrote is text you do not control, and a run with network access can read or change external systems and send data out. The model chooses network access for each run, so treat Tasks that can use Code Execution as having the third property.
Removing one property removes the need for this specific external-action gate. It does not eliminate prompt injection or a separate legal, financial, or business approval requirement.
If the Tasks of an Agent Identity need all three properties, add the gate before they acquire the last one.
Remove one property instead
You can also remove one property:
- Move
- Split the work across independent capability boundaries
- What changes
- One Task reads content you do not control; a separate authorized process independently validates or approves a constrained proposal before it acts
- Move
- Narrow the Grant
- What changes
- An Agent Identity that cannot reach the sensitive Library loses property two
- Move
- Make the Tool propose rather than act
- What changes
- The Tool writes a proposal record; a separate process executes accepted proposals
- Move
- Use one Agent Identity for each user or trust boundary
- What changes
- Earlier Tasks of other users stop being a source of text you do not control
The third move also stays safe when the same Tool request is delivered twice.
What Duale AI bounds
Duale AI limits Task duration, delegated work, model turns, resource reach, Code Execution, and file ingestion. These limits reduce the possible impact of unsafe content. They do not authorize an External Effect, provide a per-request Tool allowlist, recall work already sent out, or undo an Effect. Use one deadline for each Task and What one code run can do state the bounds, and Stop the Task you intend to stop explains what Stop ends.
Page access owns the browser and network boundary for fetched web content. Code Execution owns the state, network modes, and request limits of a code run. Tenant access policies and credential lifecycle own credential reach and revocation. MCP Connections owns the shared remote account and whole-catalog boundary.
Apply the three-property gate above. Secure integration covers authorization, human approval when required, repeat safety, and reconciliation.
Return to Security to place this threat model in the lifecycle of one Task.