Prompt injection becomes dangerous when an AI agent can turn instructions hidden in a document, email or web page into real actions. OpenRouter tested 25 attacks against four current models and found that defenses placed outside the model were more reliable than prompt wording alone.
Simply labeling documents as untrusted data cut successful attack emails from 60 to 13 across 720 attempts. That improvement cost nothing, but did not eliminate the risk. Model choice also mattered: one model produced 58 of the original 60 attack emails, supporting the use of allowlists based on an application’s own evaluations.
The strongest result came from checking every proposed tool call with OpenRouter’s Armor policy layer before application code ran it. It blocked all 73 malicious email attempts in the expanded test and added a median of about 0.3 seconds per tool call. The filter was not frictionless: it blocked one legitimate request when a user approved an address found only inside the document.
The experiment supports a layered design. Applications should keep secrets out of prompts, restrict what each key can access and treat external content as data, but consequential actions still need a separate rule-enforcement step that the model cannot rewrite.