Why Prompt Filtering Alone Is Not Enough

Most agent-security tooling today is a filter. It scans the prompt, looks for known injection patterns, and blocks anything that looks suspicious. That's a reasonable first line of defense, but it is not a security boundary. Here's why.

Filters fail on novelty

A filter can only catch what it's been trained to recognize. Attackers are constantly finding new encodings, obfuscations, and split-attack techniques that slip past pattern matching. The moment you rely on a filter, you're in an arms race you will lose. The attacker only needs to find one gap; you need to close them all.

Filters can't see provenance

The most dangerous attacks aren't a single obvious injection. They're a poisoned memory or retrieved document that looks benign and quietly steers a later action. A filter scanning the prompt can't tell you where that content came from or whether it's allowed to act. It has no concept of origin, and origin is the whole game.

Filters confuse evidence with authority

A filter produces a classification: "this looks suspicious" or "this looks clean." But a clean classification is not permission to act. The failure mode is treating a green check as a decision, when it's really just a reading. The two must never be conflated. A classifier result is evidence, never authority.

What actually works: enforcement at the action boundary

Instead of trying to catch every attack at the input, verify every action at the output. Before a tool executes, check: where did the influencing content come from? Does it have the authority to trigger this action? Is this action consistent with the agent's actual task?

This is the difference between a filter and a boundary. A filter tries to keep bad things out. A boundary verifies that nothing acts unless it can prove it's allowed to. That's the model AgentInterdict is built on, and it's the only approach that holds up against attacks you haven't seen yet.