Prompt Injection: The Vulnerability With No Patch

Instructions and data share one channel by construction, so an agent cannot reliably tell your orders from an attacker’s. Direct injection, indirect injection, and tool-output poisoning — and why containment, not detection, is the strategy that holds.

Content current as of 2026-09.

Lessons

  1. One channel: why this is not a bug
  2. Direct injection: the user is the attacker
  3. Indirect injection: the kill chain
  4. Reading the disclosure record
  5. Detection is a layer, containment is the strategy