The system as described is not susceptible to prompt injection: - The tool-using-LLM never sees data, only variables that are placeholders for the data. - A p

The system as described is not susceptible to prompt injection: - The tool-using-LLM never sees data, only variables that are placeholders for the data. - A post tool-using-LLM templating layer translates variables into content before passing them to a concrete tool. - After variables are translated, only a non-priviledged (non-tool-using) LLM has access to the actual content. - The output of a non-priviledged LLM is again another variable represented e.g. by the tokens $OUTPUT. The tool LLM never sees into that content. It can give it to another tool, but it cannot see inside it. You can inject prompt into the non-priviledged LLM but it doesn't get to do anything.