Composio introduces Agent firewall to block prompt injection
Start here
Composio published a post introducing how its Agent Firewall reduces the risk of indirect prompt injection when agents read emails or Slack messages, arguing for a four-layer combination: least privilege, isolating untrusted content, adding runtime checks between the agent and tools, and enforcing human confirmation. The article says it can intercept calls before tool execution, or intercept content before results enter the model; a check that judges whether a single call is appropriate based on task context is still labeled as coming soon. The post cites the AgentDojo paper, noting that read-only tasks still have limitations even after removing write tools.
Generated by AI from reports · Updated 7 days ago
Attention and developments
Attention, hourly
Now 29, 0% in 24 hours·Peak 31 (Nov 6 03:00)
Related research
Cited in the reports
- Design Patterns for Securing LLM Agents against Prompt InjectionsWhen an AI agent reads email or calls tools, how to stop prompt injection
arXiv · 2025-06-10
- AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM AgentsWhen an AI agent reads email or calls tools, how to stop prompt injection
arXiv · 2024-06-19 · Deep reading
Progress timeline
- ComposioWhen an AI agent reads email or calls tools, how to stop prompt injection
The article argues for a four-layer combination of least privilege, isolating untrusted content, adding runtime checks between the agent and tools, and mandatory human confirmation, to reduce the risk of indirect prompt injection for agents that read email or Slack messages. Using Composio Agent Firewall's session hooks as an example, the article explains that calls can be intercepted before tool execution, or content can be intercepted before results enter the model; a check that judges whether a given call is appropriate based on task context is still marked as coming soon on the product page. The article cites the AgentDojo paper to show that removing write tools from read-only tasks still has limitations, for example an approved send tool can still send to unauthorized recipients, and notes that no detector can make unrestricted tool access safe, and that post-execution checks cannot retract an email already sent or a file already deleted. When Zero Data Retention is enabled, checks that depend on historical context may fail to intercept.
Related discussion
Attention trend
New sources per day
- Nov 5: 1 new sources (1 outlets, 0 accounts)
- Nov 6: 0 new sources (0 outlets, 0 accounts)
- Nov 7: 0 new sources (0 outlets, 0 accounts)
- Nov 8: 0 new sources (0 outlets, 0 accounts)
- Nov 9: 0 new sources (0 outlets, 0 accounts)
- Nov 10: 0 new sources (0 outlets, 0 accounts)
- Nov 11: 0 new sources (0 outlets, 0 accounts)
- Nov 12: 0 new sources (0 outlets, 0 accounts)
- Nov 13: 0 new sources (0 outlets, 0 accounts)