Key Concepts
- 1Prompt injection is when malicious content — in a product review, a web page, an email, or user input — tries to hijack the agent's instructions and make it misbehave
- 2In commerce the stakes are concrete: injection could try to extract discounts, leak other users' data, bypass guardrails, or manipulate the agent into unauthorized actions
- 3Untrusted content must be treated as data, not instructions: the agent should never execute directives found inside retrieved product data, reviews, or user-supplied text
- 4Defense is layered: input sanitization, clear separation of system instructions from untrusted content, output guardrails, and never putting sensitive data where injection can reach it
- 5Critical actions must be enforced in code, not just prompt rules, because injection specifically targets prompt-level instructions that can be overridden
- 6The confused-deputy risk: an injected instruction can trick the agent into using its legitimate authority (refunds, data access) for the attacker — bounded authority limits the blast radius
- 7Injection defense must be tested adversarially and continuously, because attackers adapt and new injection vectors emerge as the agent gains capabilities
Why It Matters for PMs
Concrete security stakes: In commerce, injection can extract discounts, leak data, or trigger unauthorized actions. Defense is a genuine security requirement, not theoretical.
Data-not-instructions principle: Treating untrusted content as data and enforcing critical actions in code is the core architectural defense PMs must insist on.
Bounded authority limits blast radius: Because injection exploits the agent's legitimate powers, limiting refund/data authority caps how much damage a successful injection can do.
Test Your Understanding
Question 1 (Multiple Choice)
What is prompt injection in a commerce agent?
Question 2 (Multiple Choice)
How should untrusted content (reviews, web pages, user text) be treated?
Question 3 (Multiple Choice)
Why must critical actions be enforced in code, not just prompt rules?
Question 4 (Short Answer)
How would you design an agent so injected instructions in product reviews can't trigger unauthorized actions?
Think about your answer before revealing the explanation.
Question 5 (Short Answer)
What is the confused-deputy risk in agent injection, and how does bounded authority mitigate it?
Think about your answer before revealing the explanation.