Prompt Injection Cannot Be Fixed With Better Prompts, Only Contained by Design

Prompt injection is a structural vulnerability in large language models where untrusted text — such as web pages, emails, or documents fed into a model — can hijack the model's behavior by mimicking authoritative instructions. Because LLMs process all input as a single flat stream of tokens, they have no reliable way to distinguish a developer's system prompt from an attacker's embedded command. Defenses like stricter system prompts or content filters fail because they are simply more text competing within the same architecture, unable to close the underlying gap. Security experts argue the correct approach is to build systems where a compromised model cannot cause damage, using techniques such as separating authorization logic from the model, tagging untrusted content by provenance, constraining the model's output to pre-approved actions, and requiring human confirmation for consequential operations. Limiting each tool's permissions to the minimum necessary ensures that even a successfully hijacked agent has little ability to exfiltrate data or cause harm.