Design Partner Inquiry: Prompt Injection Hardening for Agent Fleets

[aeris-systems]

Hi Dust team 👋

I've been following your engineering work (especially the System Prompt Learning post) and the scale you've achieved — 80,000 agents and 12M conversations. Impressive.

I'm Alex Chen (ex-VP Engineering at Cloudflare, 18 years in security). I'm building Aeris PromptShield — open-source prompt injection detection focused on:

• Multi-language attacks and obfuscation patterns (base64, unicode, leetspeak)
• Layered detection (regex + ML + semantic analysis)
• Audit-friendly outputs for compliance (useful alongside SOC 2 / HIPAA requirements)

The question I hear from enterprise buyers is consistent: "How do you protect agents against prompt injection from web content, tool outputs, and retrieved documents?"

PromptShield gives platforms like Dust a concrete answer — especially for agentic browsing and tool-output injection scenarios.

Would you be interested in a design partner collaboration? Looking for 1-2 teams using high-risk connectors where we can validate the integration and share learnings.

GitHub: https://github.com/aeris-systems/aeris-promptshield

Happy to jump on a call or continue async here.

— Alex

[zmarouf]

Hi Alex! Can you ping us on security@dust.tt and we can go from there? Thanks!

[kinthaiofficial]

Prompt injection hardening for agent fleets is one of the hardest problems in production agent systems — it's especially tricky because the attack surface is proportional to how capable you make the agent.

A few approaches that provide meaningful protection:

Source-tagged context compartmentalization — never mix user-controlled content with system instructions in the same prompt position. Instead, use structured input where each chunk is tagged with its source: [USER_CONTENT]...[/USER_CONTENT] and [TOOL_RESULT]...[/TOOL_RESULT]. The model is instructed to treat tagged blocks as data, not instructions. Not perfect, but raises the bar significantly.

Pre-screening tool inputs and outputs — before injecting a tool result (web page, email, API response) into the agent's context, run it through a lightweight injection detector. Look for: instructions to ignore previous instructions, requests to take actions outside scope, credential-seeking patterns. A small fine-tuned classifier or even regex rules catch the most common attacks.

Capability narrowing at execution time — the most effective defense is limiting what the agent can do even if successfully injected. An agent that can only read specific files and call specific APIs can't exfiltrate data even if injected code tries to instruct it to. Monotonic capability narrowing (child agent capabilities ⊂ parent agent capabilities) helps enforce this.

Signed delegation chain as evidence — if every delegation is signed by the originating principal, a successful injection attack that causes the agent to take an unauthorized action leaves a verifiable forensic trail. You know which input triggered which action.

Budget as a circuit breaker — an injected agent that tries to exfiltrate data by making many external API calls will exhaust its budget quickly. Budget exhaustion is suspicious and can trigger review.

We've built several of these layers into KinthAI's agent execution environment: https://blog.kinthai.ai/openclaw-multi-tenancy-why-vm-per-user-doesnt-scale covers the isolation model; the delegation/audit layer: https://blog.kinthai.ai/221-agents-multi-agent-coordination-lessons

What's your current threat model — external web content injection, or insider attacks via user-provided inputs?