A few months ago I wrote about regression-testing prompts before shipping them. The responses that stuck with me weren't about prompts at all — they were about what happens when the model behind the prompt gets tools. A prompt that misbehaves wastes tokens. An agent that misbehaves deletes rows, emails strangers, or exfiltrates files it was never supposed to read.
This is the failure mode behind a question that's been circulating on DEV lately: we keep handing AI agents more tools, and the boundary between "allowed" and "possible" is mostly a polite request in a system prompt.
This article is the natural sequel to my prompt-regression workflow: a small, repeatable harness that tries to break your agent's tool boundaries on purpose, so you find the leaks in CI instead of in production. Everything here runs against whatever model you have access to — including free ones — because adversarial testing burns a lot of tokens and nobody wants a surprise invoice for their own red team.
The threat model, kept small
You don't need a PhD in prompt injection to get started. Most boundary failures in real agent setups fall into four buckets:
