I’ve used the phrase “prompt injection” in passing across several posts without ever stopping to define it properly, and after this week’s run of security stories, it’s worth doing that directly.
A normal software vulnerability exploits a flaw in code. Prompt injection exploits something structurally different: the fact that a language model can’t reliably tell the difference between “instructions I should follow” and “text I’m just reading.” Everything an agent sees — your actual request, a file’s contents, a webpage it fetched, a log entry, a GitHub issue someone else wrote — arrives as the same kind of thing: text in the context window. If that text contains something phrased like an instruction, a model trained to follow instructions has a real chance of following it, regardless of who actually wrote it or where it came from.
Direct injection is the simple version: someone types a malicious instruction straight into a chat, trying to get the model to ignore its own guidelines. Indirect injection is the version that actually matters for agents, because agents don’t just read what you type — they read files, fetch pages, and process tool output autonomously. A malicious instruction hidden in a webpage, a code comment, or a support ticket can reach the model without you ever seeing it, let alone typing it. GhostJacking is a clean example: a firewall dutifully logs a blocked malicious payload verbatim, an agent later reads that log as part of routine triage, and executes what it finds — the injection rode in inside data the agent was never suspicious of because it came from a security tool.
This is also the connective tissue running under most of what I covered this week. The repeated sandbox escape pattern and the OpenAI–Hugging Face incident aren’t textbook prompt injection — nobody planted malicious text for a model to misread — but they share the same root shape: a boundary that assumes an agent will treat certain input as data stayed intact right up until it didn’t. Prompt injection is that failure mode specifically applied to text the model reads and reasons over, rather than files it executes or sandboxes it escapes.
Why it’s genuinely harder to fix than a normal bug: you can patch a buffer overflow because the flaw is in code you control. You can’t fully “patch” a model’s tendency to treat plausible-looking instructions as instructions, because that tendency is the same capability that makes it useful in the first place — an agent that couldn’t be influenced by instructions embedded in the content it processes would also struggle to follow legitimate instructions embedded in, say, a well-structured README or a ticket describing what needs fixing. The mitigations that actually help are architectural rather than a single fix: isolating untrusted content from privileged actions, requiring explicit approval before a tool call with real-world effects, and — going back to what a sandbox is actually for — making sure that even a successfully injected instruction can’t reach anything more damaging than the sandbox it’s contained in.
