Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks

Chong Xiang, Drew Zagieboylo, Shaona Ghosh, Sanjay Kariyappa, Kai Greshake, Hanshen Xiao, Chaowei Xiao and G. Edward Suh propose system-level defenses for indirect prompt injection. Their position paper argues for security-aware replanning, bounded model judgments and human involvement where intent is ambiguous.^[1]

The proposed architecture separates plans, policies, execution and approval. The authors criticize benchmarks that omit dynamic tasks and adaptive attack objectives. These are design arguments, not measured efficacy guarantees for a newly validated defense.^[1]

Historical context

Original v1 submitted March 31, 2026. Selected positions, architecture and benchmark critique inspected, including rendered p.2. Cited defenses and benchmarks were not independently audited. Compare the 2024 training experiment and the concept for a different level of intervention.^[1]