Break Your Java Agent Before Someone Else Does

An AI agent follows instructions hidden in the content it reads. A poisoned document or a malicious tool result arrives as trusted input, and once MCP and tools grant the agent real privileges, a planted sentence can move money, delete data, or leak a key.

Prompt injection tops the OWASP Top 10 for LLM applications, and there is no one-size-fits-all fix for that: a model reads instructions and data as one input. The coding agent you work with every day has the same weakness, and it runs with access to your shell and your repository.

But there are defenses that hold for both, and I’ll build them live: in LangChain4j for the agent you ship, and in the permission controls of the agent that writes code with you.

You will know the exact place in your agent, and in your coding workflow, where a planted instruction would land, and what to build there as a proper defense.