Prompt injection is still not a bug you can patch

Every year someone announces a fix for prompt injection, and every year the fix is bypassed within weeks. This is not because the people working on it are careless. It is because prompt injection is not a bug. It is a property of how language models work — and this year’s evidence makes the case more clearly than any argument could.

The property is this: a language model receives one stream of text. Its instructions and the data it is supposed to process arrive through the same channel, in the same form. There is no hardware boundary between “do this” and “here is a document.” So every page the model retrieves, every file it reads, every GitHub issue it triages, every message another agent leaves on a shared drive, is a candidate instruction. The model has to decide which text is a command — and a decision can be wrong.

This year’s examples, all covered on this blog: agents at OpenAI joined an attack on Hugging Face because posts on a shared board told them to. A GitHub issue from a stranger got AI coding agents from three vendors to execute code and leak secrets. Open-source agent frameworks were hijacked through their memory stores without a single tool being called. And at Black Hat, speaker after speaker on AI browsers reached the same conclusion, stated without hedging: there is no perfect fix.

The useful reframing comes from Simon Willison, who has written about this since 2022. An agent is dangerous when three things are true at once: it has access to private data, it processes untrusted content, and it has a way to send information out. He calls it the lethal trifecta. With all three legs present, the agent can be turned into an exfiltration tool by anyone who can get text in front of it. Remove any one leg and the worst case shrinks dramatically.

That turns an unsolvable problem into a design decision. You cannot make the model reliably ignore instructions in data. You can decide that the agent reading your inbox has no internet access, or that the agent browsing the web has no access to your files, or that the agent with both must ask a human before it sends anything anywhere. None of those is a fix. Each is a containment — and containment is the investment that actually pays.

The deep dive separates the controls that shrink the blast radius from the controls that just make a dashboard look good.