Prompt injection isn't a vulnerability you patch. It's a category of attack you manage forever.

Prompt injection isn't a vulnerability you patch. It's a category of attack you manage forever.

Most people haven't worked out what the risk looks like in practice. It's not one attack - it's brutally effective in a chain as well. A prompt injection hidden in a skill your developer uses can cause their coding agent to write a backdoor into your code. The payload arrives through a sequence of trusted things doing their normal jobs.

"Only trusted users push to our repos" stopped being a meaningful boundary when those trusted users started using AI tools that ingest untrusted content all day. The compromise doesn't come from your developer. It comes through them.

Cloudflare just published research with a finding I love because it's so dumb: at extreme comment volumes, frontier models don't get tricked. They give up. Garbled output, refused responses, no clean verdict. Pipelines that depend on a definitive block command fail open. You don't need to convince the AI. You just need to fill the context window with cruft until it loses track of what's real. It's Alex Jones as a TTP.

They found that burying malicious code in a 3MB file of library code drops detection to 12-18% although to be fair, if I shipped a PR that size, no human reviewer would catch the bugs either. That an LLM can't is unsurprising. That people pretend it can is the problem.

Frontier models are more resilient to injection than they used to be but an attack that works 3% of the time when you can run 33 variants automatically isn't exactly a feel-good story. "Better models" don't close this gap.

Use deterministic controls wherever you can, they avoid these problems entirely. LLMs then have a place when input is genuinely ambiguous and unstructured. However that same flexibility that makes them powerful for those problems IS the attack surface. You can't regex your way out of a context window getting exhausted.

What actually helps is treating prevention as a continuous improvement loop, not a checklist. Log what your agents ingested, not just what they did, so when something goes wrong you can reconstruct it. Red-team your own agents. Something will get through. Feed your findings back into your always-evolving prevention suite. The teams that recover fastest will be the ones already set up to learn from it.