prompt-injection-defenselisted

# Prompt Injection Defense Source: Mariano Mattei, "8 Layers Deep: Defending OpenClaw Against Prompt Injection in Production" (Feb 2026). Adapted from an 8-layer public-facing chain into a scoped baseline plus an escalation path, so a single-user internal tool doesn't ship ML classifiers and a Telegram approval queue it doesn't need. ## Threat model first Prompt injection is untrusted text carrying instructions that override the system prompt. "Untrusted" is broader than "typed by a stranger" — it includes: a bank's merchant/payee strings, scraped web content, a document a teammate uploaded, output from a previous tool call, anything the app didn't author itself. Pick a tier before writing code: - **Tier 1 (single-user / internal / LAN-only)**: the zero-cost baseline below. The user reviewing their own chat output already is the human-in-the-loop; don't add a second one. - **Tier 2 (multi-user internal tool, semi-trusted input)**: baseline + regex flagging surfaced in the UI. - **Tier 3 (public-facing, autonomous action, adversarial input)**: baseline + ML classifiers (LLM Guard, NOVA) + human approval gate before any side-effecting action. This is the original article's tier — don't reach for it by default. ## The zero-cost baseline (apply at every tier) Four layers, all stdlib-level, no ML models, negligible latency. Apply to every string that (a) originates outside your own code and (b) gets concatenated into an LLM prompt. ### 1. Sanitize on the way in