Prompt injection can arrive directly from a user or indirectly through retrieved files, websites and tool output. A practical defense normalizes evasions, exits obvious cases cheaply and escalates uncertainty deliberately.
Barrikade · Updated 4 August 2026An injected instruction attempts to override a trusted objective, expose protected context, induce unsafe tool use or redirect data. Indirect injection hides that instruction in content the agent retrieves rather than in the user's initial request.
Network validity does not establish semantic safety. The API call can be well formed while the action no longer serves the approved task.
Normalization is needed for encoded, Unicode and invisible-character evasions. Signatures and embeddings can resolve known or strongly related patterns cheaply. Classifiers handle less explicit language, while an optional local judge can evaluate uncertain cases at greater cost.
A tiered pipeline also provides an explainable decision path: which layer decided, how confident it was and which diagnostics are available for review.
A block verdict only matters when the surrounding application enforces it. Production defense also needs timeouts, failure policy, trusted input boundaries, tool-specific authorization, audit evidence and a safe human-review path.
Barrikade therefore describes Core as a working-alpha detector and session-security foundation, not as a guarantee that every prompt injection or downstream exploit will be contained.