Direct and indirect injection both bypass filters
Attackers rephrase, encode, and reformat instructions to slip past keyword and regex-based defenses in either channel.
By risk
You can't prompt your way out of prompt injection.
A model can't reliably tell your instructions apart from instructions hidden in the data it reads. Defense has to live outside the model-scrubbing input, redacting output, and denying high-risk actions by default.
Why it matters
Keyword filters can't catch what they can't parse
Tools turn a leaked instruction into an action
An agent with tool access doesn't just repeat a hijacked instruction back-it can execute it against real systems.
Defense has to live outside the model
Prompt-level mitigation shares a channel with the attack. Runtime infrastructure the attacker can't talk to is the only layer that holds.
What Lineation does
Four controls that break the lethal trifecta
Input scrubbing before ingestion
Incoming data is inspected before the agent ever sees it, stripping or flagging injection-pattern content.
Output redaction
PII, secrets, and credentials are redacted from outputs before they reach a user, tool, or external system.
Default-deny on high-risk actions
An agent that reads support tickets has no business writing to the payments API-by policy, not by hope.
Replayable lineage
Every flagged attempt is captured for replay, so an injection attempt is visible and investigable.
How it works
Five steps to breaking the trifecta
Inspect incoming content
Documents, web pages, and MCP responses are checked before ingestion.
Strip or flag injection patterns
Known injection-style content is removed or marked before the agent processes it.
Evaluate the next action
Every proposed action is checked against least-privilege policy before execution.
Redact sensitive output
PII, secrets, and credentials are stripped from output before it leaves the boundary.
Log the full chain
Anything flagged is captured for replay and investigation.
FAQ
Common questions
What's the difference between direct and indirect injection?
Direct injection is typed straight into the agent's input. Indirect injection hides in third-party content the agent later reads, making the victim someone else entirely.
Why doesn't a better system prompt fix this?
A model can't reliably distinguish your instructions from instructions hidden in data it processes. Real defense has to sit outside the model, in infrastructure.
What is the lethal trifecta?
Private data access, exposure to untrusted content, and external communication, combined in one agent. Strip any one leg and exfiltration gets much harder.
Does input scrubbing break legitimate instructional language?
Scrubbing targets known injection patterns embedded in untrusted data sources, not normal instructions from an authenticated user.
Does this add latency to the agent?
Inspection runs inline at the gateway with negligible added latency on the happy path.
Where can I read a deeper explainer on prompt injection?
See the full prompt injection guide for direct versus indirect injection and the lethal trifecta in depth.
Break the lethal trifecta before it breaks you.
Turn on input scrubbing and output redaction across your agents in minutes.