When an AI agent reads email or calls tools, how to stop prompt injection

The article argues for a four-layer combination of least privilege, isolating untrusted content, adding runtime checks between the agent and tools, and mandatory human confirmation, to reduce the risk of indirect prompt injection for agents that read email or Slack messages. Using Composio Agent Firewall's session hooks as an example, the article explains that calls can be intercepted before tool execution, or content can be intercepted before results enter the model; a check that judges whether a given call is appropriate based on task context is still marked as coming soon on the product page. The article cites the AgentDojo paper to show that removing write tools from read-only tasks still has limitations, for example an approved send tool can still send to unauthorized recipients, and notes that no detector can make unrestricted tool access safe, and that post-execution checks cannot retract an email already sent or a file already deleted. When Zero Data Retention is enabled, checks that depend on historical context may fail to intercept.