What is prompt injection? (And why filters do not stop it)

What prompt injection is

An LLM reads the system prompt, the user request, and the web page it just fetched as one undifferentiated stream of tokens. Nothing marks which of them may issue orders. OWASP tracks the flaw as LLM01. Direct injection is typed in by the user. Indirect injection is planted in an inbound email, a calendar invite, a log line, or a page footer the agent reads later. That version is the one that matters for deployed agents, because the attacker never needs an account.

It stopped being theoretical

Unit 42 catalogued 22 distinct delivery techniques on live pages: zero font size or off-screen text (37.8% of cases), HTML attribute cloaking (19.8%), and CSS rendering suppression (16.9%). 85.2% wrapped the payload in social-engineering framing, a fake authority or invented persona, rather than the old "ignore previous instructions" string signature rules look for. Cloud Security Alliance measured a 32% rise in malicious injected content across billions of crawled pages between November 2025 and February 2026, and found that only 1 of 8 major Q1 2026 agent incidents received a CVE. Vulnerability feeds will not surface this class for a review.

What to control instead

OWASP states that fool-proof prevention is unclear, so detection is the wrong control surface. Meta's Agents Rule of Two is the usable version: inside one session, an agent should hold no more than two of processing untrusted input, reaching private data, and changing state or sending outbound. Remove one leg and the exfiltration path closes. Controls that survive an audit: per-agent least-privilege tool scopes, human approval on writes, payments and outbound sends, an egress allowlist covering markdown image domains, and a retained log of every tool call. If an agent reads inbound mail and can also send, gate the send first.