Prompt injection is the SQL injection of LLM systems: an exploitation of the boundary between code and data — except the boundary is the model's attention, and it may never fully exist. Every agent with tool access inherits the problem; every defense so far is risk reduction, not a cure.

The taxonomy matters because the two classes have different economics. Direct injection— a user typing "ignore your instructions" — is the manageable case: input filtering, hardened system prompts, and output validation all apply. Indirect injection is the production nightmare: a malicious instruction hiding in content the agent legitimately retrieves — a poisoned web page, a crafted support ticket, a comment in a dependency's README, a table in a PDF. The agent cannot tell "text describing an attack" from "an attack," because both are just tokens in its context, and no filtering of user input touches them.

The honest defense stack is layered, and starts by giving up on a fantasy. Marking and spotlighting — delimiting untrusted content and instructing the model to treat it as data — helps at the margins and is defeated by determined payloads. Instruction hierarchiesin newer models help at the margins too. The load-bearing layers are architectural: least-privilege tools (the agent that can only read cannot exfiltrate), the control-plane split (policy is not in the prompt, so injected text cannot vote), human gates on consequential actions, and egress control — the exfiltration needs a network path, and denying it converts most attacks into noise.

Threat-Modeling Questions

• What does the agent read? Every retrieval source is an attack surface with an owner — name them and assess them like dependencies, because they are.
• What can one injected sentence do? Trace the worst action reachable from poisoned text through the actual tool set; that is your real exposure.
• Where does output go? Agent output rendered in another user's browser, or fed into another agent, chains the attack — treat outputs as inputs.
• What is the blast-radius budget? Assume injection succeeds somewhere, sometime; size the damage the moment it does, and gate accordingly.

The sober conclusion is also the useful one: prompt injection relocated trust from the model to the architecture. Systems designed on "the model will obey" remain vulnerable; systems designed on "the model will eventually be fooled, so bound what being fooled can do" ship, survive audits, and keep their users.