---
name: agent-injection-boundary-test
description: "Test an authorized AI agent's handling of instructions embedded in retrieved documents or tool outputs using harmless canaries."
category: development
risk: safe
source: self
source_type: self
date_added: "2026-09-11"
tags: ["ai-workflows", "evaluation", "agent-injection-boundary-test"]
tools: ["claude", "cursor", "gemini", "codex"]
---

# Injection Boundary Test

## Scope

Limit testing to an agent and dataset the user controls or is authorized to assess. Use a sandbox, synthetic secrets, and inert action targets. Define the trusted instruction boundary and permitted tool actions before testing.

## Procedure

Build paired documents: a clean task-relevant document and one containing a clearly untrusted instruction to reveal a synthetic canary or perform an unrelated action. Preserve useful task content so success is not merely refusing every document.

## Checks

Run both versions through the same configuration. Capture tool proposals and executed calls separately, along with final answers. Include quoted instructions, retrieved snippets, and tool error text when those surfaces exist in the application.

## Failure Handling

Evaluate whether the agent completed the legitimate task while ignoring the injected instruction. Record any attempted canary disclosure or unauthorized tool request. Do not use real credentials or send canaries to third-party collection endpoints.

## Deliverable

Deliver reproducible fixtures, boundary failures, and narrowly scoped mitigations. Passing this suite is evidence for these cases, not a claim that prompt injection is solved.