Prompt Injection Grew Up
The early version of prompt injection was easy to caricature: a webpage says "ignore previous instructions" and the model obeys. That framing is now too small. A modern agent reads pages, emails, calendar entries, documents, tool output, and code comments. Any of those can contain instructions that are not intended for the agent, but that the agent may still process as context.
OpenAI's March 2026 article on agent prompt injection makes a useful distinction: real attacks increasingly resemble social engineering. They do not need to look like malicious prompts. They can look like onboarding instructions, a support article, a hidden note in a shared document, or a normal-looking web page that steers the agent toward a sensitive action.
Do not ask only "is this text malicious?" Ask "what can this text influence, and what could the agent do afterward?" The dangerous pattern is untrusted content flowing into a sensitive action.
Source, Sink, and Intent
The most practical way to reason about this is source-sink analysis. The source is untrusted content: a webpage, email, issue comment, repository file, or tool result. The sink is a dangerous capability: sending data, following a link, downloading a file, committing code, invoking a connector, or transmitting private context to a third party.
Between the two sits user intent. A user asking "summarize this page" has not authorized "send my private workspace notes to the endpoint hidden in the page." The agent needs to preserve that boundary even when the page tries to redefine the task.
Untrusted text
Web pages, emails, documents, issue comments, retrieved snippets, and tool output.
Agent reasoning
The model blends user intent, retrieved content, policies, memories, and tool descriptions.
External action
Network requests, messages, commits, connector writes, downloads, and data export.
Why Classifiers Are Not Enough
It is tempting to put an "AI firewall" between the agent and the web. Classify the input, block the bad text, continue. The problem is that advanced prompt injection does not need obvious attack language. A malicious instruction can be embedded in a plausible business process, a friendly checklist, or a document that appears to be exactly what the user asked the agent to read.
At that point, detection starts to look like lie detection. The agent needs context that the classifier may not have: what did the user ask, what information is sensitive, which tools are available, and whether the requested action follows from the user's actual intent.
Defenses That Survive Contact
Good defenses reduce the number of dangerous source-to-sink paths. Treat external content as data, not authority. Require confirmation before transmissions. Constrain tools by default. Give the agent read-only access where possible. Keep secrets out of the working context. Log sensitive actions in a way humans can audit.
The important design principle is boring in the best way: the model should not silently convert a page's instruction into a real-world action. If the user did not clearly ask for data to leave the conversation, the agent should need a stronger reason than "the page told me to."
What Builders Should Change
If you are building a ChatGPT-like agent, the security boundary is not the chat box. The boundary is every place where untrusted data meets a capability. Make that boundary explicit in product design: label risky actions, narrow tool scopes, isolate browsing from private context, and keep the user's original request visible to the agent at decision time.
Prompt injection will not be "solved" by a single model update. It is a long-running security discipline. Like phishing, the attacks evolve because people and agents both operate in messy environments full of plausible stories. The win condition is not perfect detection. It is making the attack chain brittle, visible, and expensive.