Tool-call checking against rules the model cannot change stopped all 73 attack emails in testing, while labeling documents as data alone only reduced them. Shows which layers to prioritize for agents that read untrusted content.
Key takeaways · AI-distilled
OpenRouter advises wrapping untrusted content in a tag with a random name generated per request, because with a fixed tag like <document> an attacker can write the closing tag inside the document and place their own text outside it.
In OpenRouter's tests, the best-working outside-written attack had no injection keywords or encoding: a 'process note' asking for a receipt email in the document's own voice. GLM 5.3 Flash sent 58 of the 60 attack emails, which OpenRouter cites to argue for a model tool permissionsThe rules governing which tools an agent may call and which need confirmation — the boundary between a mistake and an incident.Full definition →.
OpenRouter's Armor has two rule types: a hard_deny rule can never be cleared, even if the user asks, while a soft_deny rule blocks a tool call unless the user asked for that exact operation on that exact target. That is how it separates user requests from injections.
Armor blocked 55 of 80 legitimate sends when the user approved a document's instruction without naming the recipient, but none when the user named the address. OpenRouter measured median latency on tool-calling responses at 3.65 seconds with Armor versus 3.37 without.
On the Chat Completions API, Armor's default text mode puts a blocked call into the reply as a marker, and in 19 of OpenRouter's 73 blocked calls that marker contained the secret. OpenRouter says to strip it before showing or storing replies, and to start new rules in audit mode.
Terms in this piece · Glossary
prompt injection — An attack that hides instructions in content an AI will read — a webpage, email, or document — tricking it into following the attacker instead of the user.
guardrails — The checks around a model that block bad inputs and outputs — filters, validators, and permission rules the model itself can't override.
tool permissions — The rules governing which tools an agent may call and which need confirmation — the boundary between a mistake and an incident.
