12.11 Prompt Injection Defense

Claude Code defends against prompt injection attacks through multiple mechanisms:

Structured Message Defense

API message format provides natural isolation:
- role: "user"     -> User input
- role: "assistant" -> Model output
- role: "tool_result" -> Tool output (model knows this is not a user instruction)

The Anthropic API's message structure naturally provides a layer of isolation: the model can distinguish between content directly input by the user (user messages) and content returned by tools (tool_result messages). This means that even if malicious file content is read and returned to the model, the model knows it is tool output rather than user instructions.

system-reminder Tag Defense