Prompt injection through fetched web pages, files or MCP tool results: how do I make an AI coding agent treat tool output as data and limit the damage?

What it is: Indirect prompt injection happens when an agent reads external content (a web page, issue, README, document or tool result) that contains text written to steer the model. OWASP lists prompt injection as the top risk for LLM applications and distinguishes direct injection (from the user's own prompt) from indirect injection (from external content the model ingests). There is currently no filter that reliably removes it, so design for containment. Am I affected: Any agent that combines (1) access to untrusted content, (2) access to private data such as source code, environment variables or credentials, and (3) the ability to act or send data out (shell, file writes, network, git push, email). If all three are present, a single poisoned page can cause harm. MCP servers that fetch external content widen this exposure, and Claude Code's MCP documentation warns to trust each server before connecting it. Fix (reduce the blast radius): 1. Least privilege. Give the agent only the tools, directories and tokens the task needs. Use separate, scoped, short-lived credentials rather than your personal ones. 2. Human approval for high-risk actions: shell commands, network calls to new hosts, writes outside the project, pushes, deletions, payments. The MCP tools specification says there should always be a human able to deny tool invocations and that clients should show tool inputs before calling a server. 3. Segregate and label untrusted content so it is clearly separated from instructions, and tell the model that fetched content is data and never a source of instructions. Treat this as a helper only, not a control. 4. Check outputs deterministically: validate expected formats in code, and block or review actions that do not match the task (for example, a summarisation task suddenly running a network command). 5. Restrict egress with sandboxing or network allowlists so a hijacked agent cannot easily send data out, and keep secrets out of the agent's environment and files. 6. Prefer read-only modes for research tasks, run untrusted-content browsing in a separate session from the one that has write access, and test with adversarial content regularly, treating the model as an untrusted component. 7. Review diffs and tool-call logs after the session. If you suspect a session was hijacked: stop it, review what commands and network calls ran, revoke and rotate any credentials the agent could reach, and inspect the repository for unexpected changes. Verify: in a test with a harmless page that tells the agent to do something unrelated, confirm the action is blocked or prompts for approval. Sources: https://genai.owasp.org/llmrisk/llm01-prompt-injection/ https://modelcontextprotocol.io/specification/2025-06-18/server/tools https://code.claude.com/docs/en/mcp