If it's in the context window, it's an instruction.

If it's in the context window, it's an instruction.

A recent prompt injection POC drives this home with a pull request that adds a config file pointing to a PNG file.

A coding agent reads that file, opens the image, and follows the instructions rendered in the image itself telling the agent to pull and exfiltrate secrets from environment variable files.

Same text but in plain text? The AI reviewers caught it immediately. Simply draw it inside a PNG and it slips right past and prompt injects the agent.

You can't prompt your way out of prompt injection, the same way "don't hallucinate" never fixed hallucinations. Models can't reliably distinguish your instructions from an attacker's, because both arrive the same way: as content.

Guardrails inside the prompt are like childproofing a house by explaining the rules to the toddler. They're a suggestion, not a control.

Agents need deterministic controls - hard limits on what the system can do, no matter what it reads.

Everything else is just asking nicely.