The prompt injection problem is getting worse, not better

Prompt injection has graduated from research curiosity to the leading blocker for enterprise agent deployments, and the trend line points the wrong way: every new capability agents gain widens the attack surface.

Why it is worsening

• ▸Agents now read email, browse the web and execute tools — each input channel is an injection vector
• ▸Multi-agent systems propagate injected instructions between agents
• ▸Defenses remain probabilistic; no deployed system claims categorical immunity

Current mitigations

• ▸Privilege separation: the model that reads untrusted content cannot invoke sensitive tools
• ▸Instruction-hierarchy training that improves — but does not guarantee — resistance
• ▸Human confirmation gates on irreversible actions

"We treat every token from outside the trust boundary as adversarial. It's the only assumption that has survived contact with red teams." — CISO, quoted at a security conference

Standards work is underway, but for now architecture — not model choice — is the primary defense.