Why a firewall cannot stop prompt injection, but can flag exfiltration

An AI agent such as a coding assistant reads text, decides what to do and acts on the Mac: it runs commands, opens files and calls tools. If some of that text was written by an attacker, the agent can be steered. This lesson separates two problems that are often confused: stopping the steering, and limiting what the steering can achieve.

What prompt injection is, and why a firewall does not see it

OWASP defines a prompt injection vulnerability as one that occurs when prompts alter a model’s behaviour or output in unintended ways. It also states that, because of the stochastic way models work, it is unclear whether fool-proof methods of prevention exist. Its mitigations are layered: constrain the model’s behaviour, filter inputs and outputs, enforce least privilege, require human approval for high-risk actions, separate untrusted content and test adversarially.

A host firewall sits at a different layer. It sees processes and their network connections. The instructions an agent receives travel inside encrypted connections: TLS is designed to prevent eavesdropping, tampering and message forgery, so the content is not visible from outside, and a firewall is not inside the agent. It also cannot see which tool an agent calls or which files it reads. A firewall therefore cannot detect, let alone prevent, a prompt injection.

What the attack still needs: a way out

MITRE ATT&CK groups the techniques adversaries use to steal data under the tactic Exfiltration. Its entries include sending data over an existing, legitimate web service instead of a dedicated command channel, and sending it in fixed-size chunks to stay under thresholds. Whatever the attacker’s method, stolen data has to leave the Mac through a network connection made by some process.

That is the point where a firewall can help. It cannot know why the agent connected, but it can know that the connection is unlike any the agent has made before, or that the volume is unlike any it has sent before. Those two facts can be measured without reading the content.

Signal 1: a first-ever destination

A coding agent has a routine. It talks to its own vendor’s service, to a package registry, to a code host. The set is small and stable. A baseline records it: for a period, the firewall notes the destinations each agent contacts, grouped by registrable domain so that one service with many hostnames counts once. After that, a destination outside the set is a departure from the agent’s own history, and a reasonable moment to ask the person.

Signal 2: an upload spike

Agents mostly download: documentation, packages, model responses. An hour in which an agent uploads far more than ever before stands out. A useful rule compares the current hour with the busiest hour so far, and also sets an absolute floor, so that a quiet agent’s small fluctuations do not raise flags. FireAI’s Agent profile, new in its next version, uses at least 4 times the busiest hour so far and never less than 25 MB. Only host names and byte counts are used, never the payload.

What the two signals do not catch

• Data sent to a destination the agent already uses, in amounts within its usual range, raises no flag. An attacker who knows the baseline can try to stay inside it.
• A baseline cannot be useful until it has learned something. During FireAI’s 3-day learning period nothing is flagged, and anything harmful done in that period can become part of normal (see the lesson on learning a baseline).
• Local damage, such as deleting files or reading a key without sending it, produces no network signal at all.
• Recognising the agent matters: traffic from a program that is not identified as an agent is not part of the agent’s baseline.

Layers, not substitutes

The two controls act on different things. An agent-side control judges what the agent is about to do. A network control observes what actually left the machine. Neither replaces least privilege, which keeps the agent from holding secrets it does not need, or human approval for high-risk actions. When you assess any product in this area, ask which layer it works at, what it cannot see from there, and what it does when it is unsure.