AgentGuard: Cursor Rules for Context Isolation & Injection Defense

No, and no product can. An LLM receives instructions and data as the same tokens, so a defence phrased as an instruction competes with the attacker in the same channel. What these rules do is make a successful injection survivable: the threat model marks each attack as eliminated or merely reduced, and every eliminated one is a check in code rather than a sentence in a prompt.

20-tool-parameter-validation. It is the layer that holds after the model has been persuaded — resolved-path containment, argument vectors instead of shell strings, allowlists rather than blocklists, and identity taken from the authenticated session rather than from an argument. That last line alone closes a class of cross-tenant data breach that no prompt-level defence covers.

No, deliberately. Classifier detection is bypassed by paraphrase and encoding, it flags legitimate security discussion, and — the real objection — deploying one tends to displace the architectural work that actually holds. One of the documented anti-patterns is a team that expanded their agent's capabilities on the strength of a detector, then had it bypassed by a request written in French.

They are benign by design: each asks for a harmless marker — a canary string, a scratch file, a report of what the agent noticed — rather than doing damage, so they are safe to run repeatedly in a test environment and unambiguous to score. Run them against your own agent only, and never against production or a real customer record.

Taken seriously, these rules reduce what your agent may do autonomously. An agent that reads untrusted content and also holds a capability worth abusing cannot be made safe by a rule file — the two have to be separated, usually by a human confirmation step or a second agent with no network egress. That trade is stated up front rather than buried.