Prompt Injection: The Agent Era's SQL Injection

When a model only reads what you type, it is clear what counts as an instruction. When a model reads a webpage, a PDF, an email, or a tool response, the boundary gets fuzzy. Any text anywhere in its context window might say do this instead, and the model might obey.

Two flavors

• Direct injection: the user types the attack themselves (often to bypass safety)
• Indirect injection: someone else planted the attack in content the model reads

Why this is the agent era's SQL injection

In the web era, SQL injection happened because developers concatenated user input into database queries. The database could not tell code from data. Prompt injection has the same shape: the model cannot reliably tell instructions from content.

The difference is worse: SQL injection is fixed by parameterized queries. There is no known full fix for prompt injection. Current defenses reduce it; none eliminate it.

Defenses that help

1. 1Instruction isolation: system prompt in a privileged channel the model is trained to trust more
2. 2Content labeling: mark document text as data, not instructions
3. 3Capability gating: never let the model send email without a human click
4. 4Sandboxing: agents run in constrained environments with no network
5. 5Output filtering: scan results for suspicious patterns before acting
6. 6User confirmation: high-stakes actions require explicit approval

“Every piece of data an agent reads is a potential prompt. Design like every document is a letter from an adversary.”

The big idea: the more useful AI agents get, the more they read from the world, and the more they read, the more attack surface they have. Mitigations exist; a perfect fix does not.