Anthropic published work on prompt-injection defenses while Claude expanded across Microsoft enterprise platforms.

A webpage, email, document or ticket can contain instructions designed to redirect an agent. Model safeguards help, but untrusted content should never be allowed to define its own authority.

An agent reading a vendor website should not automatically gain permission to send mail, export files or update systems. Tool privileges should remain separate from whatever the model requests.

Use least privilege, allow-listed tools, separation of duties, approval for sensitive actions, content boundaries, detailed logs and anomaly monitoring. Add agent scenarios to normal application-security reviews.

Sources available by this date: Anthropic: Prompt-injection defenses, Nov. 24 2025 | Anthropic: Claude in Microsoft Foundry and 365 Copilot, Nov. 18 2025