Prompt Injection Is an Architectural Flaw, Not a Filter Problem

Prompt injection occurs when untrusted external text enters the same token stream as trusted system instructions, making it impossible for a language model to distinguish between the two sources. Unlike jailbreaking, which targets a vendor's reputation, prompt injection is a data-security threat where an attacker can hijack an AI agent's tools — such as email or calendars — to steal user information. Security researchers found that most published defenses fail at rates above 90 percent, with live red teams defeating all known filters entirely. Structural solutions such as Simon Willison's Dual-LLM pattern and Google DeepMind's CaMeL address the problem by ensuring that models processing untrusted content never share context with models that hold sensitive data or tool access. A practical implementation using three isolated models — costing roughly $0.0035 per run — demonstrates that safe AI agent design depends on architecture, not content filtering.