Agent Security Hardening

Security patterns for production AI agents. This is not about network firewalls or server hardening (see agent-deployment-checklist for that). This is about making the agent itself resistant to adversarial inputs, data leaks, and operational failures.

The 7 Rules of Prompt Injection Defense

These rules are non-negotiable. Every production agent must follow all seven.

Rule 1: Summarize, Don't Parrot

Principle: Never echo back external content verbatim. Always summarize or rephrase.

Why: Prompt injection attacks embed instructions in external content (emails, web pages, documents). If the agent parrots the content, those instructions can hijack the agent's behavior.