Testing Agents for Prompt Injection and Tenant Leaks
Practical tests to run before every release of an AI agent feature.
Where injected instructions hide
Agents read documents, emails, tickets and web pages. Any of these can contain text written to look like instructions. The rule is simple: content the agent retrieves is data, never instructions. Tests should prove the agent behaves that way.
A release test set
Keep a fixed set of adversarial cases and run them on every change to prompts, tools or models.
- A document that asks the agent to email its contents elsewhere.
- A ticket that asks for another customer's records.
- A page that tells the agent to ignore earlier rules.
- Inputs that try to trigger long, costly loops.
Tenant isolation
Vector stores and caches can mix data between customers if keys or filters are wrong, which OWASP covers under Vector and Embedding Weaknesses, LLM08. Test that a query in one tenant can never return another tenant's chunks, and enforce the filter in code, not in the prompt.
- Treat retrieved content as data, never instructions.
- Run a fixed adversarial test set on every change.
- Enforce tenant filters in code.
Write five adversarial test inputs for one agent and record how it responded to each.
Check your understanding
1. How should an agent treat text inside a retrieved document?
2. Where should tenant filters be enforced?
3. When should the adversarial test set run?
From USD 49 or INR 2,999 a month. A person approves every step.