Prompt Injection in AI Agents Is a Privilege Problem, Not a Filtering One

A software developer argues that prompt injection attacks on AI agents cannot be reliably stopped through text filtering or classifier-based defenses, since all such measures depend on the model behaving correctly on inputs it did not generate. The core issue, the author contends, is architectural: large language models receive instructions and data through a single undifferentiated channel, making it structurally impossible to separate trusted commands from untrusted content at the protocol level. Rather than trying to detect malicious input, the proposed solution is to limit what a compromised model can actually do by restricting tool access and credentials. Practically, this means splitting agent responsibilities so that the component reading untrusted content holds no credentials or tools, while a separate component that never sees raw external text is the only one permitted to act. Additional safeguards include having the model return proposed actions for schema validation rather than executing tool calls directly, ensuring a hostile instruction can influence output but not reach sensitive operations.