Prompt injection in LLM features in Next.js

Keep the system instruction in a fixed string you wrote. Pass user content and retrieved documents as separate user or tool messages, and wrap them in a delimiter you tell the model is data. That raises the bar. It does not make injection impossible.

Authorize every tool on the server:

async function refund(userId: string, orderId: string) {
  const user = await getCurrentUser();
  if (!user || user.id !== userId) throw new Error("Unauthorized");
  const order = await findOrder(user.id, orderId);
  if (!order) throw new Error("Not found");
  // only then call Stripe
}

Do not give the model a tool that runs arbitrary SQL or shell. If you need a database read, expose a function that queries one scoped thing.

Strip secrets from anything you put in the prompt. Do not paste .env into a "help me debug" feature in production.