Most vulnerability classes are eventually closed. Injection into a database query was solved by separating the query from its parameters, so the data could no longer be read as instruction. That fix works because the two travel on different channels.
A language model has one channel. The system instruction, the conversation, and every document retrieved on its behalf arrive as one sequence of tokens, and the model decides what to treat as an instruction by reading it. There is no parameterised equivalent, because there is nowhere else to put the data.
Why this is structural rather than a defect
The separation between a system prompt and user content is a convention maintained by training, not a boundary enforced by the architecture. The model has been shaped to weight one more heavily than the other, and it usually does. Usually is the operative word, and no amount of additional training converts a tendency into a guarantee.
This is why the problem has not been fixed and is unlikely to be fixed at the model layer. Asking the model to distinguish instruction from data is asking it to solve, reliably, a question that has no reliable signal available.
Direct and indirect
The direct form is a user instructing the model to disregard its instructions. It is the version most people picture, and it is the less serious one, because the attacker is manipulating a session they already control. The damage is bounded by what that user was permitted to do anyway.
The indirect form is the real problem. Here the instruction is planted in content the model will later read, and the attacker never interacts with the system at all.
The vehicles are ordinary. A page the assistant browses. A document in a shared drive. The body of an email being summarised. A comment in a repository. The description field of a ticket. Text rendered in a colour matching its background, or placed in metadata a human reader will never look at. Anything that reaches the context is a candidate.
Tools convert nuisance into consequence
An injected instruction into a model that only produces text yields wrong text. The same instruction into a model holding tools yields an action, taken with that system's credentials.
This is the arrangement where a privileged component acts on instructions supplied by an untrusted source, and the crucial point is that the component is behaving exactly as designed. Nothing is compromised. The agent read some text, interpreted it as guidance, and did what it appeared to be asked to do.
Exfiltration is the most commonly demonstrated outcome, and it rarely requires anything dramatic. If output is rendered as rich text, an image reference pointing at an attacker controlled address will fetch that address when displayed, carrying whatever was appended to the path. If the agent can make a network request, the request itself is the channel. The instruction only has to persuade the model to include something sensitive in a destination it already has permission to reach.
Persistence makes it worse
A single manipulated response is bounded. A system that carries memory between sessions is not, because an injected instruction can be written into that memory and take effect on every subsequent conversation.
The pattern is simple. Content read during one task contains text asking the assistant to remember something, that text is stored as a legitimate looking preference or fact, and it is then loaded into context on later occasions when the original document is nowhere in sight. The injection has outlived the injection point, and tracing the behaviour back to its source is genuinely difficult, because the offending content is no longer part of the conversation.
Anything written to durable memory as a result of processing untrusted content should be treated as untrusted itself, which in practice means restricting what an agent may write to memory rather than only what it may read.
Why filtering does not work
The natural response is to scan incoming content for instruction like text and strip it, and this fails for a familiar reason.
The space of phrasings is unbounded. An instruction can be indirect, spread across several sentences, expressed in another language, encoded, or written as a description of what a helpful assistant would do rather than as a command. A filter tight enough to catch these rejects legitimate content constantly, and a filter loose enough to be usable catches only the obvious cases.
Adding an instruction to the system prompt telling the model to ignore instructions found in retrieved content is similarly weak. It raises the bar slightly and is defeated by phrasing that does not look like an instruction. Both approaches are worth having as a first layer and neither should be relied upon.
What actually reduces the risk
Since the input cannot be trusted, the defences have to sit around the model rather than inside it.
| Measure | What it limits |
|---|---|
| Reduce authority | How much a followed instruction can accomplish |
| Separate reading from acting | Whether the component holding credentials read the content |
| Constrain egress | Where data can be sent, closing exfiltration channels |
| Confirm irreversible actions | Damage that cannot be undone |
| Treat output as untrusted | What downstream systems will execute or render |
The last row is worth stating plainly. If output flows into a shell, a query, or a rendering layer, the ordinary defences for that layer still apply and matter more rather than less, because the source is now manipulable.
The realistic posture
Prevention is not currently available, and treating it as achievable produces systems designed on a false assumption. The workable position is that injection will succeed occasionally, and the system should be built so that success is contained, visible, and reversible.
That reframes the design question usefully. Not whether the model can be tricked, which it can, but what the worst outcome is when it is, how quickly that becomes apparent, and how long it takes to undo.
Note: the useful analogy is not the injection vulnerability that was solved by parameterisation. It is social engineering, where the target is a component that can be persuaded, and the defence has always been limiting what a persuaded party is able to do.