Prompt Injection Is an Authority-Boundary Failure

The attack works because instructions and data share a language

Prompt injection places malicious instructions inside content the model is asked to read, such as a webpage, document or tool result. OpenAI describes prompt injection as an industry-wide frontier security challenge and has developed instruction-hierarchy training to help models distinguish higher-trust instructions from untrusted content.

The problem becomes materially more serious when the model can call tools. A hidden instruction in retrieved content is no longer only capable of changing text output; it may try to redirect browsing, disclose information or influence an action the user never requested.

OWASP similarly classifies prompt injection as a leading risk for LLM applications. The recurring architectural mistake is allowing retrieved content to cross from the data plane into the control plane without an independent policy decision.

Model robustness is necessary but not sufficient

Training models to respect instruction hierarchy improves resistance, but system architecture still needs least privilege. An agent reading a public webpage should not automatically inherit access to sensitive mail, internal documents or consequential actions simply because those tools are available in the same session.

Strong designs separate untrusted observation from privileged action, scope tool permissions to the current task, require confirmation for consequential changes, and validate outputs before another system executes them.

The security objective is therefore not “detect every malicious prompt.” It is to make sure that a successful prompt injection still encounters independent boundaries before it can convert text into authority.