Prompt injection

A language model receives one undifferentiated stream of tokens. Your instructions, the system prompt, the document it was asked to summarise, the output of a tool — all of it arrives in the same context with no cryptographic or structural marker separating “authority” from “material”.

Prompt injection is what happens when something in the material gets treated as authority.

Direct and indirect

Direct injection is a user typing something adversarial at a model they are already talking to. It matters for products with a system prompt worth protecting, and it is largely a problem between the vendor and their own user.

Indirect injection is the one that matters for agents. The text arrives inside content the agent was legitimately asked to process — a GitHub issue, a dependency README, a web page, an MCP tool result, a PDF — from a party who was never in the conversation and whom nobody chose to trust.

The asymmetry is what makes it dangerous. You asked the agent to triage some issues. Someone who can file an issue can now put text in front of your agent, and your agent has your credentials.

Why it is not a bug to be patched

It is tempting to treat this as an implementation defect awaiting a fix. It is better understood as a structural property: the model’s ability to follow instructions written in natural language is the capability, and the inability to reliably distinguish instructions from content is the same capability seen from the other side.

Defences exist and help. Prompt hardening, input classifiers and confirmation dialogs all reduce the rate. None closes the class, and all three share a dependency — they are enforced by, or mediated through, the system the attack subverts. Treat any claim of prevention with suspicion.

The containment framing

The productive move is to separate the attack from its consequence.

An injected instruction is only a security incident if it can become an operation against something valuable. If the agent’s filesystem, network, execution and capability authority is deny-by-default and scoped to the task, then a successful injection produces an attempt that is denied and recorded. The attacker wins the argument with the model and collects nothing.

This is also why detection is the wrong goal for a containment layer. BitShout does not try to identify injection, because doing so would mean interpreting natural language to guess intent — reintroducing exactly the unreliable step it is designed to be independent of. An injected agent and a confused agent produce identical requests, and both are handled correctly.

See prompt injection containment for the full argument.