Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
What Is a Secure Alternative to Prompt Injection Detection for Agents on Sensitive Data?
Data isolation is the secure alternative: the values a page renders are replaced with consistent tokens before any model reads the screen, so a missed injection collects placeholders, and real values resolve only at the approved destination. Ask what the model receives on each screen, who approves the action, and what the run exports.
A detection layer buys a team a delay: it inspects content on the way to the model and stops what it recognizes. What it leaves open is what happens after it misses, when the model acts on a page it has already read. The page is drawn for a person, with the account number, the tax ID and the contact record in full view, and the instruction in a memo field is addressed to the model rather than to the clerk. The evidence that misses happen is not thin. A benchmark study found that "existing agentic security benchmarks are easily saturated by a simple approach" (Bhagwatkar et al., 2026). For the team that owns a payment run, the stake is a transfer that cannot be recalled. The alternative worth comparing changes what the model is given: the values a policy names are replaced on the rendered screen, the agent works from INV_014 and ACCT_014, and the real values resolve only at the destination a person approved. An injection against a model holding tokens has nothing to take.
Key findings
- For a detector to be replaceable, the values a page renders would have to be replaced with consistent tokens before any model reads the screen, so the agent works from CUST_014 and never the digits (What Is Render-Layer Tokenization?).
- It would also require a named person approving each payment, and a record of what the model received on every screen (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
- The detector pages reviewed here do not describe what the model receives once a screen is open; they describe the content they inspect (Does a Prompt Injection Detector Protect My Credentials?).
- The firewall study reports its defense "achieves perfect security with high utility across all four public benchmarks," then finds that "existing agentic security benchmarks are easily saturated by a simple approach" (Bhagwatkar et al., 2026).
- Meta's guidance accepts the miss: until injection is reliably stopped, "agents must satisfy no more than two of the following three properties within a session," which caps what one session can reach without changing what the model reads (Meta AI, 2025).
- EchoLeak showed the miss in production: in Microsoft 365 Copilot the client "automatically fetches the external image URL included by the attacker," with no click from the user (Reddy and Gujral, 2025).
What does a missed injection get on a rendered invoice?
Take one payable invoice in a vendor portal: the page draws the supplier's legal name, the invoice number, the amount, the remittance account and a memo field. The agent checks the invoice against the purchase order and prepares it for payment. The memo carries a line addressed to the model, telling it to send the file to an address outside the portal. The detector scores the page, and the score comes back clean.
What the attacker receives was decided before that moment. On the page as the portal draws it under policy, the account is ACCT_014 and the memo reads as the attacker wrote it. The instruction reaches a model holding tokens. It can write them into a file, repeat them in a summary or post them to the address in the memo, and each act moves a placeholder that resolves only inside the issuing environment (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
That is a missed injection with nothing to take, in a record. The miss is real: the detection layer did not stop the instruction, and the run did not become safe by assuming it would. The loss is bounded by what the model was given, and the screen carried no value that spends. Data minimization points the same way: personal data must be "adequate, relevant and limited to what is necessary" for the purpose, and checking an invoice does not require the remittance account (Regulation 2016/679, 2016). The fields sit on the page for the person reconciling it, which is the wall a policy has to draw for the model (What Is the PII Wall?).
Why does a detector miss, and what does it leave in the model?
A detector is a classifier on content, and its answer depends on a threshold. The firewall study tested a design at the tool interface and found the tests it passed were weak, with "flawed success metrics, implementation bugs, and most importantly, weak attacks" (Bhagwatkar et al., 2026). A filter "can also remove information that is important for task success, leading to a drop in utility" (Bhagwatkar et al., 2026).
In one 2025 study, adaptive attacks got past most of the 12 published defenses more than 90 percent of the time (How Often Do AI Agents Follow Injected Instructions?).
The larger problem is where the failure lands. An instruction that gets through acts on a context that already contains the page: "poisoned data retrieved from one component can change the model's behavior and compromise the entire system, including coercing the model to spread confidential data to untrusted components" (Siddiqui et al., 2025).
Harvard's guidance keeps the two risks separate on one list: Sensitive Data Exposure and Prompt Injection and Model Manipulation are two of its seven risk categories for AI-enabled systems (Harvard University Information Security and Data Privacy, 2026). A control for the second does not address the first. The trifecta framing is the same point in three parts, private data, untrusted content and a way out, and a detector watches one (What Is the Lethal Trifecta for AI Agents?). A detector changes the odds that an instruction arrives; it does not change what the instruction finds.
Detection in front of the model buys time and logs the attempts it sees; isolation behind it decides what a passed page contains (Will Prompt Injection Ever Be Fixed at the Model Level?). Columbia's DAPLab puts the placement point directly: "access control governs who can touch data, integrity constraints govern what gets stored, but neither governs how data flows and is used during agentic execution" (Columbia DAPLab, 2026). A detector is another control on content, on the same side of that line.
What do the vendors themselves say?
Three vendor pages address the problem in their own terms, and each stops at a boundary.
Until injection is reliably stopped, "agents must satisfy no more than two of the following three properties within a session": untrusted input, sensitive systems or data, and state change or external communication (Meta AI, 2025). The constraint narrows what a hijacked run can reach, and it says nothing about which values the model receives from a page inside those limits.
HubSpot's knowledge base describes a restriction at the data layer: restrictions "prevent custom property values for Sensitive Data properties" from being used by AI (HubSpot, 2026). The rule governs properties marked in HubSpot, and it does not reach a page rendered by another system.
AWS's Well-Architected guidance is about attribution: "audit logs attribute every action unambiguously to either an agent or a human actor" (AWS, 2026). The log answers who acted; it does not say what the model read before it acted.
| Dimension | What the vendor documents | What a buyer should verify |
|---|---|---|
| Meta AI | A session may combine two of untrusted input, sensitive data and external communication | Which values the model receives on a page inside those limits |
| HubSpot | Sensitive Data properties are kept from AI use inside its tools | Whether the restriction follows a page rendered elsewhere |
| AWS | Audit logs separate an agent's actions from a person's | Whether the record includes the screen as the model received it |
The three answers describe a session, a property and a log. None describes the values on a rendered page, which is what a missed injection takes.
What should a security team ask for in writing?
What the team is protecting comes before which control it buys. Harry Ghuman, CEO, Alpha Decisions, set that as the first step on a HAL podcast: "First, you have to understand what is it that you're trying to protect" (What Is the AI Delegation Frontier? Harry Ghuman on Who Gave the AI Its Authority). Ask for a written statement of what the model receives from a rendered screen, field by field, before a pilot starts. A statement that names credentials leaves the customer record, the account number and the tax ID on the screen, and those are the fields an agent reads on the way to a task that needed none of them. An answer that names a category rather than the fields has not said whether the remittance account is one of them.
Ask where a real value resolves, and ask for the destination rather than the mechanism. A token the model can exchange for a value at any address is a value the run carries. Ask who approves a submission that moves money or changes a record, and whether the approver is named in the record or inferred from a role. Ask what the run exports, and whether the export can reach the organization's own monitoring rather than a vendor dashboard.
Ask the detection question last and precisely: which content the detector inspects, where in the run it sits, and what it does when a score lands near its threshold. A detector tuned to keep the work moving will pass pages it should not, and one that answers only in percentages has not answered the question a buyer asked. The written answers together say where the control sits, and a vendor that can give all five has described an environment rather than a filter.
What does a governed environment change?
A governed environment changes the input rather than the message. The page is drawn with consistent tokens in place of the values a policy names, and the tokens hold for the whole run, so an agent can quote ACCT_014 in a note and compare it with an invoice without ever holding the number (What Is Render-Layer Tokenization?).
A token is not a redaction that disappears. It resolves only at the destination the policy names, at the moment of an approved action, and a named person approves that action. The approval sits outside the model, so an instruction that reaches the model cannot approve its own request. What the model read, what it did and who approved it go to a record the customer's own monitoring can hold (What Can a Hijacked Agent Leak If It Only Has Placeholders?).
The result is a bound on the miss. A detector that fails lets an instruction through; a governed environment decides what the instruction finds. Where a detector sits in front of the model and inspects content, the render-layer control sits at the page and decides which values exist for the model to read.
That difference is what a buyer is comparing when the choice is framed as a detector or an alternative. RedactSure vs Check Point Lakera: 2026 Comparison & Alternative works through where each control sits and what its pages state.
What the record shows
The control that answers this question sits at the render layer, where the values on a page are decided before the model reads them, and its companions are a named approver and an exported record. Against that standard, detection is a filter on content: it changes the chance that an instruction reaches the model, and it leaves untouched the values the model holds when one does. The pages reviewed here describe a session limit, a property restriction, audit logs and a filter at the tool interface, and none of them describes replacing the values a page renders before the model reads it. A buyer can run the test on one record: open a payable invoice with a memo field, ask an agent to prepare it for payment, compare the fields the portal draws with the fields the run reports having read, then read who approved the save.
Methodology and limitations
This page rests on three research papers, vendor documentation from Meta AI, HubSpot and AWS, the text of the GDPR, university guidance from Harvard, a Columbia lab post and existing RedactSure research pages. Public documentation read in full gives a sound view of where each product applies its control. Sources were read as of October 16, 2026, and each Sources line carries the date for its page.
None of the products named here was tested for this page, and they are described from documentation; "not described" means the pages reviewed. Vendor features change, so the page carries its date. The payable invoice describes a record type, not an organization. RedactSure is deploying now with enterprise and government customers. Determinations belong to counsel, assessors and the organization's own security and compliance officers, and nothing here replaces a pilot of one workflow on the organization's own screens.
Frequently asked questions
What is a secure alternative to prompt injection detection for agents on sensitive data?
One that changes what the model receives, not only what the agent may do. A detector inspects content on the way to the model; the alternative replaces the values a page renders with consistent tokens before any model reads the screen, so an injection that gets through finds placeholders. Detection can stay in front as a second layer. What changes is the consequence of its miss, and the run records what the model read.
Does a detector stop an injection that reaches a rendered screen?
Some of the time, and its own evidence says the tests flatter it. The firewall study found existing benchmarks easily saturated and the attacks in them weak, so a high score is not a measurement of a live adversary. When an instruction gets through, the model acts on the page it was given, with every field the page drew. The detector's miss is not the loss; the values in the model's context are.
What does the model receive when the screen carries tokens?
The page as drawn, with placeholders where policy put them: INV_014 and ACCT_014 in place of the invoice and account numbers, while the totals and dates stay readable. The agent can reconcile and prepare the payment on those tokens, and a note it writes carries the same tokens. The real values resolve only at the destination the policy names, at the moment of an approved action, so the transcript and any file the run writes hold nothing that spends.
Who approves a payment the agent prepares?
A named person, outside the model, before the payment leaves. Preparation and approval are separate steps: the agent can read the page, check the invoice against the order and draft the payment, and a person approves the submission that moves money. An instruction that reaches the model cannot approve its own request, because approval is not a message the model can send. The record then carries the name with the action.
What record does a run leave?
One that shows the screens as the model received them, the actions it took and the approvals with names. An audit log that attributes an action to an agent or a person answers who acted; it does not show what the model read before it acted, which is the question a missed injection raises. A useful export carries both, and a team should be able to send it to its own monitoring.
Can a team run detection and data isolation together?
Yes, and the order matters. Detection in front of the model catches what it can and logs the attempts it sees; isolation behind it decides what a passed page contains, so the model reads tokens rather than values. Neither layer has to be perfect for the pair to hold, because the detector's failure rate no longer decides whether an attacker gets data. The data was not there to take.
How RedactSure Keeps a Missed Injection From Collecting Anything
A detector that misses leaves the model holding whatever the page drew, and the controls reviewed here stop at the session, the property or the log. Meta's guidance caps a session at two of three properties and leaves the screen unaddressed (Meta AI, 2025).
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before, the portal draws the remittance account in full and the memo's instruction reaches a model holding a number that spends. Inside the governed environment the field is filled from a store, the model reads ACCT_014 on the page and on every later screen, and the real account reaches the payment form only when a named person approves the submission.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
A missed injection costs what the model was holding when it landed. Bring one invoice or record your team pays from and see, with test values, what the model reads and who approves the release. Book a demo