The short answer
Prompt injection is when text the model reads contains instructions the model follows. Because a language model cannot reliably tell your instructions apart from content, any untrusted text in the context window is a potential command. It is not patchable at the model level; it is contained at the architecture level.
Why it is worse in agents and RAG
A RAG system retrieves documents. If someone can add a document to your corpus, they can add instructions to it.
An agent has tools. An injected instruction that reaches a tool call becomes an action, not just a wrong sentence.
Anything that summarises emails, web pages, or uploaded files is reading text an attacker may control.
How to contain it
The rule of thumb: assume everything in the context window is attacker-controlled, and design so that being wrong is survivable.
Least privilege on tools
Scope every credential to the minimum. An injected instruction can only do what the tool is allowed to do.
Human approval for consequences
Irreversible actions — sending, paying, deleting — need a confirmation the model cannot bypass.
Treat model output as untrusted
Never pass model output straight into a shell, a query, or an eval. Validate it like any user input.
Isolate contexts
Do not mix privileged instructions and untrusted content in one context when you can avoid it.
