Solutions
Prompt injection and coding agents: what it can actually reach
You cannot reliably prevent prompt injection, so the useful question is what a successful one can reach. An agent can only exfiltrate what is in its context or what its credentials let it do, which makes limiting both far more practical than trying to filter hostile text.
Your agent reads things you did not write. A GitHub issue, a README in a dependency, a web page it fetched, the output of a tool. Any of those can carry instructions, and the agent has no reliable way to tell the difference between content it was asked to read and an instruction hidden inside it. This is not theoretical: a documented case had one injection hit Claude Code, Gemini CLI and Copilot, with credentials posted into a public pull request comment, and CVE-2025-55284 covers exfiltrating secrets over DNS.
Treat it as a blast-radius problem rather than a detection problem. Anything in the context window is already in reach of an injection, which is the strongest argument for keeping credentials out of it: a key in a .env the agent read can be exfiltrated by a single crafted instruction, while a key in Vault that only ever reaches the command itself cannot be printed by an agent that never held it. The same logic applies to reach. An agent working in its own git worktree can damage its own branch rather than the tree you are sitting in, and an agent scoped to one Thread sees the notes and secrets you granted that Thread rather than everything you own. And whichever pane an instruction lands in, it cannot reach into a different pane's grant. None of this stops an injection landing. It decides what happens next.
How it works
- 1Keep credentials out of the context. A secret in Vault cannot be printed by an agent that was never handed the value.
- 2Give each agent its own worktree so a bad instruction hits its branch rather than your working tree.
- 3For a pane handling content you don't control, like a strange issue or an unfamiliar dependency, seal it off from the Thread entirely: no board, no notebooks, no Vault, nothing there worth exfiltrating.
- 4Grant notes and secrets per Thread rather than account-wide, so one compromised session does not reach the rest of your work.
- 5Be deliberate about which commands you authorise. Authorising a shell one-liner is authorising everything that one-liner can do.
- 6Rotate immediately if you suspect exposure, rather than trying to establish it first.
Straight about the guarantee: Forkbench does not detect or block prompt injection, and it does not read what your agent is sent. Everything above reduces what an injection can obtain; none of it reduces how often one arrives. An agent you deliberately authorise for a command can still misuse that command.