Building Secure AI Agents: A System-Level Defense Perspective Against Indirect Prompt Injection Attacks

For indirect prompt injection attacks against AI agents, a position paper proposes a system-level defense vision and three positions: dynamic tasks and real environments often require dynamic replanning and safety policy updates; some context-dependent safety decisions still require an LLM, but only within a system design that strictly constrains the scope of its observations and decisions; when inherently ambiguous, personalization and human-computer interaction should be core design elements. The paper also states that limitations of existing benchmarks may create false utility and a false sense of safety, and views system-level defenses as the skeleton of agent systems.