Prompt Injection Is Unfixable? The Structural Flaw in AI Agents
By Muizz Shaikh & The FourfoldAI Research Team | Last updated: October 2026
Prompt injection is not a missing null-check. It is what happens when a system reads natural language as code and as data at the same time, with no wall between the two. Prompt injection in AI agents bolts that property onto tools: mailboxes, browsers, shells, payment APIs. A hidden sentence on a web page stops being a bad answer. It becomes an action.
The UK's National Cyber Security Centre warned in December 2025 that these attacks may never be "totally mitigated" the way SQL injection was. OWASP ranks prompt injection first among LLM application risks for 2025. Microsoft, OpenAI and Anthropic all describe it as an open problem.
So can autonomous agents never be deployed safely? Or are we confusing the unpredictability of a model with the security of the system around it? This report argues for the second reading. "Fixed" has four different meanings, and the evidence gives a different answer for each one.
Key Findings: Is Prompt Injection in AI Agents Really Unfixable?
Short answer: at the model layer, yes, for now. At the system layer, no. The rest of this report shows why.
What the Evidence Establishes
No model-level defense reliably stops an LLM from treating untrusted data as instructions when the attacker adapts. In The Attacker Moves Second (October 2025), 14 researchers bypassed 12 published defenses with attack success rates above 90% for most of them. Most of those defenses had originally reported near-zero rates.
The NCSC (December 2025), OWASP (2025) and OpenAI (December 2025) land in the same place. Foolproof prevention at the model layer is unproven, and deterministic guarantees there are hard to come by. System-level controls behave differently. They cap what a hijacked model can actually do.
What Remains Uncertain
Nobody knows whether any architecture can separate instructions from data inside natural language without gutting general usefulness. CaMeL (Debenedetti et al., SaTML 2026) completes 77% of AgentDojo tasks with provable security, against 84% for an undefended agent. That price is acceptable in some deployments and not in others.
Vendor numbers are the second gap. Anthropic, OpenAI and Microsoft each publish results against their own attackers. There is no shared harness, so figures cannot be compared across vendors.
The Bottom Line for Engineering and Security Teams
Stop trying to make the model's brain impenetrable. Secure its hands, eyes and environment. Treat every model output as an untrusted remote procedure call from a stranger, and let deterministic code outside the model decide whether it runs.
Scorecard preview: instruction disambiguation, no. Action authorization, yes. Data confidentiality, partially. Formal guarantees, only inside constrained designs. The full scorecard follows the Control-Boundary Matrix.
What Is Prompt Injection in Autonomous AI Agents?
OpenAI defines prompt injection as instructions placed in external content to make a model do something the user did not ask for. For an agent that reads, decides and acts, that definition carries real weight.
Prompt Injection vs. Jailbreaks: Clearing the Confusion
A jailbreak talks a model into producing text its safety training forbids. A prompt injection hijacks the application's control flow so the system takes an action nobody authorized. One is a content problem. The other is an integrity problem.
Sources do not fully agree here. OWASP treats jailbreaking as a form of prompt injection, while many security engineers keep the two apart. We use the operational split because it points to different fixes: output controls for jailbreaks, authorization boundaries for injection.
Direct vs. Indirect Prompt Injection
In direct injection, the attacker is the user and types the payload into the chat box. In indirect injection, the attacker plants it where the agent will read it: an email, a web page, a PDF, a GitHub issue, a database row, a tool result.
MITRE ATLAS files both under technique AML.T0051 (LLM Prompt Injection), with AML.T0051.000 for direct and AML.T0051.001 for indirect. NIST's AI 100-2 E2025 (March 2025) covers both in its generative AI taxonomy. Microsoft's Security Response Center wrote in July 2025 that indirect injection is among the most widely used techniques in AI vulnerabilities reported to the company.
Indirect injection is the variant that matters for agents. The victim never types anything.
The Anatomy of an Agent Execution Compromise
An injected read-only chatbot produces a wrong or rude paragraph. An injected agent produces side effects. Wire the same model to a mailbox, a browser, a shell or an MCP server, and its output turns into requests: send this, click that, run this.
That is how a text glitch becomes an enterprise integrity breach. Microsoft's May 2026 research made the point directly: once a model is wired to tools, prompt injection becomes a code-execution primitive. Our guide to MCP tool access and AI agent security covers the connector side of that risk.
The model does nothing wrong by its own logic. It parses language into a tool schema, exactly as designed.
Why Prompt Injection Is a Structural Flaw in LLMs
The Shared Context Problem: Code and Data as One
Early computers kept instructions and data in the same memory. That is the von Neumann architecture, and it is why buffer overflows exist: attacker-supplied data got executed as code. The industry answered with structural defenses such as data execution prevention and address randomization, which Microsoft's own security team still cites as the model for impact mitigation.
LLMs have no equivalent. The system prompt, chat history, retrieved snippets and tool output arrive as one undifferentiated stream of tokens. Self-attention weighs all of it the same way. There is no out-of-band control plane.
SQL injection became solvable because parameterized queries give the database a hard boundary between query and value. The NCSC's argument (December 2025) is that an LLM offers no such boundary inside a prompt.
Memory makes it worse. When an agent writes to long-term memory, one injection can become a standing instruction that reloads in every later session. We cover that persistence in our piece on AI memory poisoning and persistent prompt injection.
Why Delimiters and System Role Prompts Fail as Security Boundaries
Wrapping untrusted content in XML tags, Markdown fences or JSON looks like a boundary. It is a suggestion. An attacker's payload can simply close the data tag and follow it with a fresh "system override" that requests a tool call. Self-attention does not treat tags as memory segment registers. It attends to meaning.
The numbers agree. In AgentDojo (NeurIPS 2024), a data-delimiter defense cut GPT-4o's targeted attack success rate from 57.69% to 41.65%. Better, and nowhere near safe.
Microsoft's Spotlighting research (Hines et al., 2024) reported drops from above 50% to below 2% on GPT-family models. Both results are real. They come from different attacks and different setups, which is the lesson: a figure measured against a fixed attack set says little about an attacker who adapts.
The Tool-Augmentation Dilemma: Expanding the Blast Radius
Every tool makes the agent more useful and the injection more valuable. In AgentDojo's 2024 Slack suite, where the agent browses pages an attacker can seed, attacks succeeded 92% of the time against GPT-4o.
Microsoft's May 2026 disclosure showed the severe end. In Semantic Kernel, one flaw (CVE-2026-26030) let model-controlled text reach an eval() call. Another (CVE-2026-25592) exposed a file-download helper to the model, so an injected prompt could drop a script into the Windows Startup folder. Microsoft's conclusion: the model is not the weak point. The tools you expose define the attacker's reach.
How Prompt Injection Becomes an Agent Security Failure: The 4-Stage Attack Chain
Picture an assistant that reads your inbox and can send mail. Here is how one poisoned message travels.
Stage 1: Encountering Untrusted Payloads
The agent retrieves something an attacker can influence: an invoice PDF, a search result, a calendar invite. Anthropic's own example is a vendor email with hidden white text telling the agent to forward anything marked "confidential" to an outside address. Microsoft notes that payloads can hide in white-on-white text or non-printing Unicode characters, and that even a plain .txt file can carry one.
Stage 2: Context Hijacking and Plan Alteration
The model reads the artifact and folds the embedded directive into its planning state. Crude payloads say "ignore previous instructions." Effective ones now look like social engineering. OpenAI (March 2026) describes realistic business context, claimed authorization and fabricated urgency. One 2025 email attack reported by outside researchers worked 50% of the time in OpenAI's testing, against a user request to research their own emails.
Stage 3: Boundary Crossing and Tool Invocation
The model emits a structured proposal: send an email to an outside address, body containing the last five messages. Everything before this point was text. This is where text becomes an instruction to a system. If the host application executes proposals blindly, the perimeter is gone.
Stage 4: Execution, Exfiltration, or System State Mutation
The host runs the call. Data leaves through a tool, a rendered image URL, or a clickable link. Microsoft's July 2025 list also includes covert channels, such as leaking one bit by calling a tool or not calling it. State changes work too: in the Semantic Kernel chain, a payload built inside a sandbox crossed the container boundary through a host-side download helper.
Four stages, one choke point. The step from proposal to execution is where an external policy layer can block, rewrite or escalate.
What Scientific Research Reveals About Prevention
OWASP LLM01:2025: Official Status of the Vulnerability
OWASP's 2025 Top 10 for LLM Applications places prompt injection at number one. Its guidance says that, given the stochastic nature of generative models, it is unclear whether foolproof prevention methods exist. That is an unusually candid sentence for a standards body. It sets the tone for everything below: mitigation, not elimination.
StruQ and Structured Query Isolation
Chen, Piet, Sitawarin and Wagner (UC Berkeley, USENIX Security 2025) proposed structured queries. A secure front end places the developer's prompt and the untrusted data in two separate channels, using reserved separators the data cannot forge. The model is then fine-tuned to follow instructions only in the prompt channel.
Results were strong against known attacks. The authors' May 2025 summary reports a worst-case attack success rate of 45% for StruQ across the attacks tested, and 8% for its successor SecAlign. The approach needs control over model training, so it suits teams running their own open-weight models. It also targets override-style payloads. Our reading is that a persuasive, socially engineered message, like OpenAI's email example, gives channel separation less to grab.
CaMeL: Defeating Prompt Injection by Architectural Design
CaMeL (Debenedetti et al., with authors spanning Google and ETH Zürich; SaTML 2026) stops asking the model to resist. It treats the LLM as an untrusted planner. A privileged model sees only the trusted user query and writes a plan as code in a restricted Python subset. A quarantined model parses untrusted data but has no tool access. A custom interpreter tracks where every value came from and attaches capabilities to it. Security policies run when tools are called. Untrusted data therefore cannot steer the program's control flow, and private data cannot flow to unauthorized destinations.
The headline: 77% of AgentDojo tasks solved with provable security, against 84% undefended (arXiv revision, June 2025; the first version reported 67%). Known limits: someone must write the policies, frequent confirmation prompts risk user fatigue, side channels remain, and text-to-text manipulation sits outside the threat model. CaMeL builds on Simon Willison's 2023 Dual LLM pattern.
AgentDojo Findings: The Utility vs. Security Trade-Off
AgentDojo (Debenedetti et al., NeurIPS 2024) contains 97 tasks and 629 security test cases across email, Slack, travel and banking environments. Its defense results show the trade-off in plain numbers. With GPT-4o, a prompt-injection detector cut attack success to 7.95%, but benign task completion fell from 69.0% to 41.49%. A simple tool filter, where the agent fixes its toolset before seeing untrusted data, dropped attack success to roughly 7%. It fails when the task's own tools suffice for the attack, which the authors found in 17% of cases.
The authors added that stronger, adaptive attacks would likely require real breakthroughs in how models separate instructions from data. These results use 2024 models, so read them as a method, not a current scoreboard.
Evaluating Industry Claims: Model Safeguards vs. Reality
Anthropic's November 2025 browser-agent post reported about a 1% attack success rate for Claude Opus 4.5 against an internal adaptive attacker with 100 attempts per environment. Anthropic called even that "meaningful risk." In August 2026 it reported that its older evaluation had hit 0% and been retired. On a harder evaluation using professional red-teamers' attacks, 17.6% of attacks that reached Opus 4.5 succeeded, versus 3.8% for Opus 5, before extra safeguards.
OpenAI's March 2026 paper takes a different route. It argues that "AI firewalls" rarely catch fully developed attacks, because detecting them resembles detecting a lie, and it designs for constrained impact instead. In December 2025 it wrote that the nature of prompt injection makes deterministic guarantees challenging.
Independent adaptive red-teaming is harsher than vendor-run testing, and both are limited. Vendor figures are self-reported, attacker-defined and not comparable. The honest reading: models are getting measurably harder to trick, and none has been shown to be un-trickable.
The FourfoldAI Control-Boundary Matrix
We built this matrix to show where each control sits in the agent stack, what it truly guarantees and where it breaks. It is our editorial synthesis of the sources above. The ratings are judgments, not measurements.
Defense Layer | Primary Control Mechanism | Target Boundary | Attacker Model Assumed | Guaranteed Protection | Residual Vulnerability / Failure Mode | Utility / Overhead Impact |
Model Fine-Tuning | Instruction-hierarchy and robustness training (RL, StruQ-style tuning) | Token attention | Known or non-adaptive attack distributions | None; probabilistic resistance only | Adaptive optimization attacks; socially engineered payloads | No runtime step; training cost; possible capability trade-offs |
Input Filtering | Guardrail models and classifiers (e.g., Prompt Shields) | Context ingestion | Known injection patterns | None formal; catches known patterns | Novel phrasing, obfuscation, persuasion; the classifier is itself a model | Added latency; false positives (one AgentDojo detector cut benign utility from 69.0% to 41.5%) |
Context Isolation | Delimiters, spotlighting, data transformation | In-context semantics | Passive, non-adaptive injection | Syntactic hints only | Delimiter escape; semantic override | Low overhead; minimal utility loss |
Architectural / Taint Flow (e.g., CaMeL) | Capabilities, provenance tracking, restricted interpreter | Execution runtime | Untrusted data trying to steer control flow or leak data | Untrusted data cannot alter plan control flow; data flows are policy-checked | Text-to-text manipulation; policy gaps; side channels; tasks where data must drive tool inputs | High engineering effort; 77% vs 84% task completion on AgentDojo |
Deterministic Authorization | External policy engine, parameter validation, scoped credentials | Tool API interface | Compromised model proposing tool calls | Hard limits on which calls can execute | Malicious calls inside the permitted scope | Low latency; needs explicit permission modeling |
Human-in-the-Loop | Out-of-band approval showing exact parameters | Real-world state change | Compromised model | Blocks unapproved high-impact actions | Approval fatigue; misleading summaries; bottleneck | High latency; limits autonomy |
The Four Meanings of "Fixed," Scored
1. Instruction disambiguation (model level): No. Can an LLM reliably tell user instructions from untrusted data in one semantic space? The NCSC, OWASP, OpenAI and the adaptive-attack results all say that nobody has shown it. Natural language has no out-of-band control plane.
2. Action authorization (tool level): Yes, for actions you can enumerate. Can an orchestration layer stop an exploited model from invoking unauthorized actions? Deterministic policy and least-privilege schemas do this. AgentDojo's tool filter and Microsoft's Semantic Kernel patches, which removed model access to dangerous functions, both show the pattern. The limit: a malicious call that sits inside a legitimate scope passes the check.
3. Data confidentiality (boundary level): Partially. Can an architecture keep sensitive context from reaching untrusted endpoints even if the model is fooled? Taint tracking, egress filtering and sandboxing help. OpenAI's Safe URL checks whether information from a conversation would be sent to a third party, then asks the user or blocks it. Microsoft deterministically blocks known exfiltration tricks like markdown image injection. Covert channels still leak.
4. Formal security guarantees (proof level): Only in constrained designs. Can an agent provably behave across arbitrary adaptive inputs? CaMeL comes closest, through capability-based design rather than a smarter model, and it pays in utility and in the policies someone must write.
Why Layering Across Boundaries Differs From Stacking Filters
Stack three classifiers at the input and you get three probabilistic judgments about the same text. They share blind spots. A payload crafted to look benign to one language-based detector often looks benign to the next. Failure is correlated, so the combined protection is weaker than the arithmetic suggests. Adaptive attackers exploit exactly that.
Layering across boundaries is different in kind. A policy engine at the tool interface does not read the payload. It checks the proposed action against rules written before the attack began. An egress filter does not care how persuasive the email was. Each layer fails for different reasons, so a payload that fools the model still meets code that never reads English.
Comparing Prompt Injection Defenses: What Do They Actually Guarantee?
Microsoft's July 2025 framing is the cleanest lens. Probabilistic defenses lower the odds of an attack. Deterministic defenses guarantee a specific attack cannot succeed, even with an LLM in the loop.
Model-Level Safeguards & Instruction Hierarchy Fine-Tuning
Training models to rank system instructions above data, as in the instruction hierarchy work (Wallace et al., 2024) and Anthropic's reinforcement-learning approach, raises the bar. It guarantees nothing. Treat it as risk reduction that must never carry the load alone.
External Input Classifiers and Guardrail Filters
Classifiers like Microsoft's Prompt Shields catch known patterns and add useful telemetry. OpenAI argues they miss well-built attacks. AgentDojo showed the utility bill: false positives can gut task completion. Use them for detection and alerting, not as the gate.
Capability-Based Security and Architectural Isolation
CaMeL and the design patterns from Beurer-Kellner et al. (2025) are the strongest evidence that structure beats persuasion. They work by limiting what untrusted data can influence. They also limit what the agent can do, so they fit workflows with predictable plans better than open-ended exploration.
Deterministic Execution Boundaries & External Policy Engines
This is OpenAI's customer-service analogy in code: refund caps, flagged phishing, rate limits, enforced outside the agent. Microsoft's Semantic Kernel fix used allowlists rather than blocklists. The failure mode is permission modeling. Rules that are too loose permit the attack. Rules that are too tight break the product.
Human-in-the-Loop (HITL) Gatekeeping: Strengths and Blind Spots
Approval gates stop irreversible mistakes, and Microsoft uses them where impact cannot be otherwise bounded. Their weakness is the human. Prompts that fire constantly get approved on reflex, and a summary written by a compromised model can describe a harmful action as routine. Show exact parameters, not paraphrases.
Enterprise AI Deployment Risk Matrix
This matrix rates common agent architectures by what a successful injection can reach. The ratings are the FourfoldAI team's editorial assessment, built from the evidence above.
Agent Architecture | Blast Radius | Primary Injection Path | Priority Controls | Risk Rating |
Autonomous coding agents | Local files, shell, dependency installs, credentials | Repo files, issues, package docs, tool output | Sandboxed execution, command allowlists, no standing credentials | High |
Browser-use agents | Authenticated sessions, forms, downloads | Any web page, ad or embedded document | Domain limits, action verification, per-action approval for sensitive steps | High |
Financial workflows | Payments, account changes, approvals | Invoices, statements, emails | Hard limits, out-of-band approval with exact parameters | High |
Email and customer support agents | Mailbox, CRM records, outbound messages | Inbound messages and attachments | Egress filtering, output encoding, scoped write access | Moderate to high |
Internal document search and read-only RAG | Content quality, internal data boundaries | Poisoned documents in the index | Source provenance, access-control-aware retrieval, no tool access | Low to moderate |
High-Risk Scenarios: Coding Agents, Browser Agents, and Financial Workflows
Coding agents combine untrusted input with execution. Microsoft's May 2026 research shows the end state: prompt injection reaching host-level code execution through ordinary tool plumbing. Browser agents inherit the whole web as an attack surface. Anthropic's November 2025 post says every page, ad and script is a possible vector, and AgentDojo's Slack results show how fast attacker-controlled tool output succeeds. Financial workflows add irreversibility. A transfer cannot be recalled by a better prompt.
Moderate-Risk Scenarios: Customer Support, Internal Document Search, and RAG
Email and support agents can exfiltrate data through links, rendered images and outbound messages, which is why Microsoft blocks those channels deterministically. Read-only retrieval carries less risk because the agent cannot act. The remaining problems are polluted answers and weak access boundaries inside the index. Add a write-capable tool and the rating changes. Our overview of the security risks of autonomous AI agents covers the governance side.
Practical Defense-in-Depth Framework for Engineering Teams
Step 1: Establish Strict Trust Boundaries Outside the Context Window
Split the decision engine from the execution engine. The LLM proposes. A deterministic proxy validates and dispatches. Meta's Agents Rule of Two (October 2025) gives a design check: within one session, an agent should combine no more than two of these: processing untrusted input, accessing sensitive systems or data, and changing state or communicating externally. If all three are needed, require supervision.
Step 2: Implement Scoped Credentials and Per-Action Capabilities
No persistent admin keys. Issue single-use, narrowly scoped capability tokens per action, ideally with cryptographic request signing so the proxy can verify who authorized what. A hijacked agent holding a token for one calendar edit cannot empty a mailbox.
Step 3: Enforce Out-of-Band Human Authorization for Irreversible Effects
Financial transfers, deletions, credential access and external sends should trigger step-up approval through a channel the model cannot touch. Display the exact parsed parameters. If a rule engine can make the decision, let it.
Step 4: Isolate Tool Execution and Egress Channels
Run browser and document-parsing agents in ephemeral sandboxes or micro-VMs. Apply egress filtering with destination allowlists. Encode or strip model output before it renders, so markdown images and links cannot carry data out. Microsoft's guidance: any tool parameter the model can influence is attacker-controlled input. Audit which functions your framework exposes to the model. One accidental annotation caused a sandbox escape.
Step 5: Continuous Red-Teaming with Adaptive Attack Benchmarks
Static cheat-sheet strings tell you little. Test against adaptive attackers and standard suites such as AgentDojo, rerun on every model, prompt or tool change. Nasr et al. (2025) found that most defenses looked safe only against weak attacks.
Research Methodology, Sources, and Epistemic Limitations
We built this report from peer-reviewed papers, official standards (NIST, OWASP, MITRE ATLAS) and primary vendor publications dated through October 2026. We opened the AgentDojo paper, the Anthropic, OpenAI and Microsoft posts and the NCSC blog in full. For CaMeL, StruQ, The Attacker Moves Second and OWASP LLM01, we relied on the abstracts and excerpts available to us, so claims about those are limited to what they state.
Evidence Hierarchy and Benchmark Nuance
Peer-reviewed results rank above vendor blogs, which rank above secondary summaries. Where numbers differ, we show the range: CaMeL reported 67% in its first version and 77% in the June 2025 revision. AgentDojo's own text cites a 7.5% tool-filter result while its table shows 6.84%, so we say "roughly 7%." Vendor attack-success rates use different attackers, models and thresholds and should not be compared across companies. Two identifiers circulating in some write-ups, T1699 and T1698 for ATLAS, do not match what we found. ATLAS lists these attacks under AML.T0051.
What This Report Does Not Claim
We do not claim that building useful agents is impossible.
We do not claim mathematical impossibility proofs exist for every neural network design.
We do not claim all current agent deployments are compromised.
What the report does establish: prompt injection remains uneliminated at the model inference layer. Relying on an LLM to police its own input is an architectural anti-pattern. Real-world security comes from shifting trust assumptions from the model to the execution runtime.
Limitations: AgentDojo results use 2024 models. Our two risk and boundary matrices are editorial judgment. Vendor numbers are unverified by third parties. This field moves quickly, so check the primary sources for updates.
Frequently Asked Questions About Prompt Injection
Is prompt injection impossible to prevent?
It cannot be eliminated at the model layer today, but its impact can be contained. The NCSC (December 2025) says it may never be totally mitigated the way SQL injection was. OWASP says it is unclear whether foolproof prevention exists. System-level controls that limit what a hijacked agent can do, such as policy engines and scoped credentials, work regardless.
Why can't guardrails and safety filters completely fix prompt injection?
Because they are models judging text, and attackers can rewrite text until the judge misses it. OpenAI (March 2026) argues that detecting a well-built attack resembles detecting a lie. In The Attacker Moves Second (2025), adaptive attacks beat 12 defenses at rates above 90% for most. Filters help as one layer, not as the gate.
What is the difference between direct and indirect prompt injection?
In direct injection the user types the attack. In indirect injection the attack hides in content the agent reads. MITRE ATLAS tracks them as AML.T0051.000 and AML.T0051.001. Indirect injection comes through emails, web pages, documents and tool outputs, which makes it the main threat to agents. Microsoft (2025) calls it one of the most widely used techniques it sees.
How does CaMeL defend against prompt injection attacks?
CaMeL keeps untrusted data away from the program that decides what the agent does. A privileged model plans from the trusted query alone, a quarantined model parses untrusted content without tools, and an interpreter enforces capability policies on data flows. It solved 77% of AgentDojo tasks with provable security versus 84% undefended (Debenedetti et al., SaTML 2026).
Can an AI agent safely browse the web or read incoming emails?
Only with constraints outside the model. Meta's Agents Rule of Two (October 2025) says an agent should not combine untrusted input, sensitive access and external actions in one session without supervision. Anthropic (November 2025) states that no browser agent is immune. Use sandboxing, egress limits and approval for sensitive actions.
Why are autonomous agents more dangerous than standard chatbots when injected?
Agents turn manipulated text into actions. A chatbot can say something wrong. An agent can send mail, write files or move money. Microsoft (May 2026) showed a single prompt reaching host-level code execution through a framework's tool plumbing. AgentDojo's Slack suite reached a 92% attack success rate against GPT-4o.
What is the difference between an LLM jailbreak and a prompt injection?
A jailbreak gets a model to produce forbidden content. A prompt injection gets an application to take an unintended action. The first is about what the model says, the second about what the system does. OWASP treats jailbreaking as a form of prompt injection, so check how a given source defines each term. We use the operational split.
What is the most effective defense against prompt injection today?
Constrain what a hijacked model can do. Deterministic authorization outside the model, scoped credentials, egress controls and approval for irreversible actions. Microsoft (July 2025) designs so successful injections carry no security impact, and OpenAI (March 2026) takes the same route. Model training and classifiers add further layers.
Conclusion: Moving Beyond the "Unfixable" Slogan
"Unfixable" is accurate only if you expect an LLM to become an infallible gatekeeper of its own context. On that count the evidence is clear. Natural language has no control plane, adaptive attackers break model-level defenses, and the NCSC and OpenAI both avoid promising deterministic guarantees.
That is not the end of the story. The same sources point to a workable path. Treat the model as a brilliant, creative and untrusted planner. Put authorization, credentials, sandboxes and approvals in code that never reads English. Pay the utility cost where the stakes demand it, as CaMeL's 77% versus 84% shows, and spend less where they do not.
Security for autonomous systems will not be won by larger models or more polite system prompts. It will be won by hardened, zero-trust architectures that assume the model will sometimes be fooled and make sure the damage stays small.
References
This article is backed by authoritative sources and research. All links were checked in October 2026.
OWASP GenAI Security Project (2025). LLM01:2025 Prompt Injection. https://genai.owasp.org/llmrisk/llm01-prompt-injection/
NIST (March 2025). AI 100-2 E2025: Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations. https://csrc.nist.gov/pubs/ai/100/2/e2025/final
Debenedetti et al. (IEEE SaTML 2026; arXiv March 2025, revised June 2025). Defeating Prompt Injections by Design (CaMeL). https://arxiv.org/abs/2503.18813. Related: Willison (2023), The Dual LLM pattern. https://simonwillison.net/2023/Apr/25/dual-llm-pattern/
Chen, Piet, Sitawarin and Wagner (USENIX Security 2025). StruQ: Defending Against Prompt Injection with Structured Queries. https://www.usenix.org/conference/usenixsecurity25/presentation/chen-sizhe. Related: Wallace et al. (2024), The Instruction Hierarchy. https://arxiv.org/abs/2404.13208
Anthropic (November 24, 2025). Mitigating the risk of prompt injections in browser use. https://www.anthropic.com/research/prompt-injection-defenses. Update: Anthropic (August 26, 2026), Claude in Chrome is generally available. https://claude.com/resources/articles/claude-in-chrome-generally-available
OpenAI (March 11, 2026). Designing AI agents to resist prompt injection. https://openai.com/index/designing-agents-to-resist-prompt-injection/. Related: OpenAI (December 2025), Continuously hardening ChatGPT Atlas against prompt injection attacks. https://openai.com/index/hardening-atlas-against-prompt-injection/
Microsoft Security Response Center (July 29, 2025). How Microsoft defends against indirect prompt injection attacks. https://www.microsoft.com/msrc/blog/2025/07/how-microsoft-defends-against-indirect-prompt-injection-attacks. Related: Hines et al. (2024), Spotlighting. https://arxiv.org/abs/2403.14720
Microsoft Defender Security Research Team (May 7, 2026). When prompts become shells: RCE vulnerabilities in AI agent frameworks. https://www.microsoft.com/en-us/security/blog/2026/05/07/prompts-become-shells-rce-vulnerabilities-ai-agent-frameworks/
MITRE ATLAS. Technique AML.T0051: LLM Prompt Injection (AML.T0051.000 Direct, AML.T0051.001 Indirect). https://atlas.mitre.org/
OWASP Cheat Sheet Series. LLM Prompt Injection Prevention Cheat Sheet. https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html
Debenedetti et al. (NeurIPS 2024, Datasets and Benchmarks). AgentDojo: A Dynamic Environment to Evaluate Prompt Injection Attacks and Defenses for LLM Agents. https://arxiv.org/abs/2406.13352
NIST (January 2023; July 2024). AI Risk Management Framework 1.0 (AI 100-1) https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.100-1.pdf and Generative AI Profile (AI 600-1). https://nvlpubs.nist.gov/nistpubs/ai/NIST.AI.600-1.pdf
Nasr, Carlini, Sitawarin et al. (October 2025). The Attacker Moves Second: Stronger Adaptive Attacks Bypass Defenses Against LLM Jailbreaks and Prompt Injections. https://arxiv.org/abs/2510.09023
UK National Cyber Security Centre (December 8, 2025). Prompt injection is not SQL injection (it may be worse). https://www.ncsc.gov.uk/blog-post/prompt-injection-is-not-sql-injection
Meta AI (October 31, 2025). Agents Rule of Two: A Practical Approach to AI Agent Security. https://ai.meta.com/blog/practical-ai-agent-security/
Explore More AI Security Research
Building or buying agents? Explore FourfoldAI's research, benchmarking frameworks and enterprise architecture analyses at fourfoldai.com.
Disclaimer: This article is for general informational and educational purposes only. It is not security, legal or professional advice, and it does not guarantee that any control will stop any attack. Test every defense in your own environment. For the full disclaimer, see https://www.fourfoldai.com/disclaimer.
About the Author
Muizz Shaikh is an AI enthusiast and digital technology professional at FourfoldAI. He is passionate about exploring AI tools, industry trends, and practical applications of emerging technologies. Through FourfoldAI, Muizz contributes to simplifying artificial intelligence for businesses and learners. Connect with him on LinkedIn: linkedin.com/in/muizz-shaikh-45b449403/
© 2026 FourfoldAI. All rights reserved.
Comments