Microsoft releases FIDES, a security system for AI agents that uses information-flow control to block prompt injection attacks

Microsoft shipped FIDES (Flow Integrity Deterministic Enforcement System) as an experimental feature in Agent Framework. Every piece of content is labeled with integrity (trusted/untrusted) and confidentiality (public/private) tags; labels propagate automatically through tool calls; policies are enforced before sensitive tools run.

FIDES stops prompt injection by making security deterministic rather than probabilistic. Instead of relying on defensive prompts or allowlists—both of which fail silently—the framework checks labels before each tool call, preventing the model from reaching privileged operations even if it is tricked by injected instructions in untrusted data.

In a concrete example, a GitHub issue triage agent can read untrusted issue bodies (labeled as such) but is prevented from calling post_comment if private content is in scope, and completely blocked from calling write_file with untrusted context. Human approval prompts surface policy violations when approval_on_violation is enabled.