Heise has published an interview with Google on how the company shields its AI agents from prompt injection.
Prompt injection — hidden instructions smuggled into the content an agent reads — is widely treated as the hardest security problem in the agent stack, because the model cannot reliably tell data from commands. An agent that reads mail, searches files or calls tools will execute an injected line just as readily as a legitimate task.
What makes the interview worth reading is that Google is describing defenses for agents it actually ships rather than a research wishlist. The emphasis is on layers instead of a single filter: separating trusted instructions from untrusted content, narrowing which tools an agent may call and with what privileges, checking outputs before they act on the outside world, and keeping humans on the hook for consequential steps.
The context is that agent security has moved from theory into procurement. Enterprises deploying agents that can read mail, query databases or spend money want an answer to injection before they sign, and no complete technical fix exists today — the open question is how much damage an injected instruction can ultimately do. Google's account of where its own limits are is useful input for anyone building, operating or buying agent systems.
