https://tilvids.com/videos/watch/1951ea59-006a-467a-be9c-ac13ff294858 Imagine your AI assistant reads your email and can send replies for you. An email arrives from someone you don't know, with a line telling the assistant to forward your recent messages to an outside address. Which instruction does it follow, yours or the stranger's? In this video I explain what prompt injection is, and why stricter instructions, grounding, delimiters or a second AI checking the input can't be relied on as the boundary. Then, using that one inbox assistant, I show where the boundary goes instead: limits on what the agent's tools can reach, enforced in code. I end with two tests for deciding what an agent can do on its own. Chapters 0:00 Your rule or the stranger's? 0:53 What is prompt injection? 2:01 Question 1: Can better wording stop this? 3:17 Why the usual defences aren't the boundary 5:18 Limit what the attack can do 7:05 So what's the point of the agent? 7:33 Question 2: How much can the agent do on its own? 9:25 The stranger's email, replayed 10:35 What to try on your next agent Sources National Cyber Security Centre, "Prompt injection is not SQL injection (it may be worse)" (2025): https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection, OWASP, "LLM01: Prompt Injection": https://genai.owasp.org/llmrisk/llm01-prompt-injection/, Hacker News, "CrabTrap: An LLM-as-a-judge HTTP proxy to secure agents in production": https://news.ycombinator.com/item?id=47850212, Which tool does your agent have that fails one of the two tests? Tell me in the comments. Sun, 08 Nov 2026 12:25:20 GMT https://validator.w3.org/feed/docs/rss2.html PeerTube - https://tilvids.com https://tilvids.com/lazy-static/avatars/a8b2efbf-2a14-445c-a432-b4ebcf28cb7d.png https://tilvids.com/videos/watch/1951ea59-006a-467a-be9c-ac13ff294858 All rights reserved, unless otherwise specified in the terms specified at https://tilvids.com/about and potential licenses granted by each content's rightholder.