Prompt Injection and the AI Bill: Give the Agent Less to See

TL;DR A long agent session can leak a secret through one poisoned issue, and bill you for the same conversation forty times. Both come from what the agent can see. Stop prompt injection by never giving one agent private data, untrusted content and a way out all at once; make secrets unreadable; and clear the context between tasks, because every turn re-sends it.

Do this: Deny your coding agent read access to .env and secret folders today, and type /clear when you switch tasks.

Part 4 proved the rate-limit tests go red at 50 and left two doors open: an issue filed against the auth service that tells the agent to post .env to a URL, and a session whose token count keeps climbing. Both are about what the agent sees.

The issue reads like a bug report, with one extra line. The agent working on the login rate limit reads it for context. If it can also read .env and reach the internet, nothing more is needed.

No exploit, no malware. Just text the agent took as an instruction.

AI Practices for Engineers, in 6 parts:

1. How LLMs Work, and How to Ask So They Stop Guessing
2. Rules Files and a Prompt Library: Make the Repo Remember
3. Run Coding Agents Without Babysitting, and Reset Them When They Loop
4. AI-Generated Code: Checks That Can Fail, and the Calls That Stay Yours
5. Prompt Injection and the AI Bill: Give the Agent Less to See (you are here)
6. Turn Repeated Fixes into Skills, Then into a Team Practice

Three legs, and you only need to break one

Prompt injection is number one on the OWASP Top 10 for LLM applications. For coding agents the kind that matters is indirect: instructions hidden in a README, an issue, a web page or a log line. Simon Willison named the combination that makes it dangerous, the lethal trifecta:

1. Access to your private data
2. Exposure to untrusted content
3. A way to communicate externally

Secrets it never sees can't leak

In about 20,000 repos with GitHub Copilot active, GitGuardian found 6.4% had leaked at least one secret, 40% above the 4.6% baseline for public repos. Run secret scanning in pre-commit and in CI, and deny the agent read access to .env and secret folders.

Where the code goes matters too. Business and API tiers of the major vendors don't train on your data by default; several consumer tiers can. A personal Pro account is a consumer surface, so company code goes only into company-approved, business-tier tools.

Every turn pays for the whole conversation

The window that holds the poisoned issue is also the one you pay for. A session holding 100K tokens that runs 40 more turns sends about four million input tokens. Nobody typed them; the conversation re-sent itself forty times.

The login rate limit session went wrong the ordinary way: after the fix landed, it moved on to the Redis bug and a review, carrying the whole history along. Context times turns drives most of the bill; model tier, effort and rework come after.

The habits that cut it cost nothing

They also stop the context rot from part 3. The smaller session is cheaper, better, and has less to leak.

Try it

Here is my agent setup: tools, MCP servers, permissions, what it reads:
<describe>. For each leg of the lethal trifecta (private data,
untrusted content, external communication), say whether this agent
has it and the cheapest change that would break that leg. Then list
the three session habits likely costing me the most tokens.

The agent can't read .env now, and you clear between tasks. But one correction comes back in every fresh session that writes the login API tests: "reuse the fixtures, don't create a raw HTTP client". You pay for it each time, and your teammates type it too. Part 6, Turn Repeated Fixes into Skills, makes the repo and the team remember it.

Read this with your AI

Read the post at <this post's URL or .md link>.
1. Summarise it in 5 bullets for a <your role>.
2. Walk me through my own setup one leg of the trifecta at a time,
   then estimate what my longest session last week cost.