Before your AI agent reads customer emails or web pages and can act on them, list what an attacker could make it do, then remove the risky paths instead of relying on filters: AI agent prompt
Prompt injection is when instructions hidden in an email, ticket, web page or file get an agent to do something its owner never asked for. In an Oct 29, 2026 write-up, Sergii Makarevych sorted 29 guardrails people run on agents that read strangers' text into two kinds: text guardrails that inspect content (classifiers, markers around untrusted text, a second model reviewing the plan) and capability guardrails that remove a path (no network access, no real credential in the agent, sending only to allowlisted addresses, no production database). He tested seven on a support-inbox assistant and reports that every text guardrail with a published adaptive-attack number was bypassed more than 50 percent of the time, while every incident fix on the public record removed a capability. His four steps: check whether the agent reads untrusted content, holds private data and can act; list your guardrails as text or capability; give each harmful outcome a capability control that makes it impossible; and keep text filters only as an extra layer. The prompt below walks a non-engineer through the same review.
The prompt
Help me review the safety of an AI agent I use or plan to use. What it does: [e.g. answers our support inbox / reads supplier emails / browses websites for research]. What it can read: [inbox, tickets, web pages, shared files]. What data or logins it holds: [customer records, payment system, email account, API keys]. What it can do: [send emails, issue refunds, edit files, run commands, post online]. 1) Tell me whether it has all three risky ingredients: it reads text strangers wrote, it holds private data or credentials, and it can act or talk to the outside. 2) List the worst things an attacker could get it to do by hiding instructions in an email or page (e.g. leak data, send money, delete files, email someone). 3) For each, propose a 'remove the path' control I can actually set up, such as approval before any send or refund, sending only to an allowlist, read-only access, separate login with limited rights, no access to the live database, or backups. 4) List any content filters or 'ignore instructions in emails' rules I rely on and explain why they are a bonus layer, not the main defense. 5) Give me 5 harmless test emails I can send to check the controls work. Keep it in plain language.
Fill in the blanks, then copy
This prompt has 3 [bracket]s to fill in. Type your details below and the prompt updates as you go. Your answers stay in this browser and are reused on other prompts with the same blanks. Nothing is sent to us.
Example values are fictional, just to show how a filled-in prompt reads. Replace them with your real details.How to use it
- Copy the prompt above.
- Replace every [bracket] with your own details (use the fill-in-the-blanks box above, which remembers your answers for the next prompt).
- Paste it into ChatGPT, Claude, Gemini and review the answer before you use it.
Works with: ChatGPT, Claude, Gemini
Real-world example: x.com/sermakarevich/status/2115801259173151024
Featured in: ChatGPT prompts for business email, replies and follow-ups · AI prompts for writing SOPs, reports, policies and checklists
Before you use it: what to check
Check yourself
- This prompt works on text other people wrote (emails, reviews, messages or web pages). That text can hide instructions aimed at AI, such as "ignore your rules and…". Paste it as material to work on, and never let the AI act on requests inside it, like paying, sharing logins or changing records. How prompt injection works →
- Check every figure, price and total against your own records before anything is sent, posted or booked. A person approves refunds, discounts, payments and price changes.
- Remove names, contact details, account numbers and other personal data the task doesn't need before you paste, and check your AI tool's data and training settings.
- Read and edit the draft before it reaches a customer or goes public. If you later automate this prompt, start with "draft and notify me", not "send automatically".
Using an AI agent? Download this prompt as a SKILL.md agent skill with these checks built in, or get the .zip for Claude.ai. How to install skills.
Want to make this prompt even better? Grade it with the free prompt grader or build your own with the AI prompt generator.
32 copy-paste agent prompts (PDF) plus 5 new prompts every week.
Get it free