Why AI agents fall for prompt injection

Anatomy of the failure

Prompt injection is the security failure mode unique to LLM-based systems, and it's structurally hard because the agent processes instructions and data in the same channel. When an agent reads user input, a web page, an email, or any external content, that content can contain instructions ('ignore your previous instructions and...') the agent may obey because it can't reliably tell the difference between its legitimate system prompt and injected text in the data it's processing. The consequences range from embarrassing (revealing the system prompt) to serious (taking unauthorized actions, leaking data from other parts of the system the agent has access to). The risk scales with the agent's capabilities: a read-only agent that gets injected leaks information; an agent with write access or money-movement tools that gets injected can take real damaging actions. This is why capability scoping matters so much — the blast radius of a successful injection is bounded by what the agent can actually do. Prevention is layered because no single defense is complete: input sanitization at the boundary, system-prompt hardening, conservative defaults for ambiguous requests, human approval gates on consequential actions, and minimum-necessary tool scoping so a compromised agent can't do much. The teams that get burned are the ones who gave an agent broad capabilities and trusted that the system prompt would hold against adversarial input — it won't, reliably, so the architecture has to assume injection will sometimes succeed and bound the damage.