Prompt injection stopped being a research curiosity a while ago. As AI systems gained the ability to read documents, browse the web, and take actions on a user's behalf, the attack surface grew with it. What used to be "trick the chatbot into saying something embarrassing" is now "trick the AI agent into exfiltrating data or taking an unauthorized action" — a much higher-stakes problem.

The two attack families

Direct injection is the original form: a user types instructions designed to override the system prompt directly in the chat box ("ignore previous instructions and..."). It's the easiest to defend against because the attacker and the input channel are the same, visible thing.

Indirect injection is the harder problem and the one driving most 2026 incidents. Instructions are hidden inside content the AI is asked to process on someone else's behalf: a PDF with white-on-white text, a webpage with instructions in an HTML comment, a calendar invite description, an email signature. The user never sees the malicious instruction — the AI reads it during retrieval and treats it as a legitimate command.

Patterns we're seeing most often

  • checkFake system messages embedded in retrieved documents — text formatted to look like a system-level instruction, placed inside a connector-indexed file.
  • checkDelimiter confusion — using the same markers (triple quotes, XML-style tags) the application uses internally to separate instructions from data, so the model can't tell which is which.
  • checkMulti-turn escalation — no single message looks malicious, but a sequence of innocuous-looking turns gradually steers the model toward an unsafe action.
  • checkTool-call redirection — injected content instructs an agent with tool access to call a different function, or the same function with attacker-chosen parameters.

Defense in depth, not a single filter

No single technique catches everything, which is why a layered approach performs meaningfully better than any one control in isolation:

Provenance tagging

Every piece of retrieved content is tagged with its source and trust level before it reaches the model, and the system prompt explicitly instructs the model to treat retrieved content as data, never as instructions — regardless of how it's formatted.

Input and output scanning

Requests and model outputs are scanned for known injection patterns and anomalous instruction-like phrasing before they're processed or acted on, catching both direct and indirect attempts.

A human approval gate on consequential actions

This is the control that matters most once an AI agent can actually do things — send an email, update a record, execute code. Even a successful injection can't cause damage on its own if the resulting write action is queued for a named human approver before it executes. This is the single highest-leverage defense against indirect injection, because it doesn't depend on catching the attack — it depends on catching the consequence.

Sandboxed tool execution

Tools an agent can call are scoped tightly (least privilege) and executed in an environment where a bad parameter can't reach anything outside its intended blast radius.

The takeaway

Prompt injection can't be fully "solved" the way a buffer overflow can be patched — it's a property of how language models process instructions and data in the same channel. The realistic goal is to make a successful injection unable to cause real-world harm, which is a governance and approval-workflow problem as much as it is a filtering problem.