Home

/

Prompt Injection: Blast Radius

/

Why this is probably structural

Why this is probably structural

Chapter 20
Part V
4
min read

Why this is probably structural

Four years after the vulnerability was named, the person who named it still says we do not know how to reliably prevent it. That is not a gap in the products. It follows from what a language model is.

A model takes a sequence of tokens and predicts the next one. Instructions and data are the same tokens. There is no channel separation because there is no channel, and the property that makes these systems useful over arbitrary text is the same property that makes them unable to refuse arbitrary text.

Better models may narrow this. Instruction hierarchies have improved and will keep improving. But a system whose safety rests on a model's judgement is a system whose safety is a probability, and an attacker gets unlimited attempts at a probability.

So the reasonable expectation is that this does not get solved in the sense of going away. It gets managed, the way memory safety was managed for thirty years before the industry changed languages, and the way SQL injection is still managed in code written last month.

That makes containment a permanent discipline rather than a stopgap. The architecture in this book is not a bridge to a future where models can be trusted. It is what building on models looks like.

What this book got wrong

Some of it. That is the nature of writing about a field moving this fast, and it is worth saying which parts are most likely.

The implementation details will date first. The framework APIs in these pages are from a product that reached 1.0 five months before publication, and two of the GitHub issues cited in chapter 14 may be closed by the time you read it.

The measurements will date next. Chapter 4's evasion evidence is from April 2025, and guardrail products have shipped since. The structural argument does not depend on those numbers, which is why the chapter was built to survive them, but a reader quoting the specific figures in 2028 should check them first.

What should last is the reasoning: that a control a model can be argued out of is not a control, that provenance is the property no classifier can supply, and that the decision belongs in code. If those turn out to be wrong, the book is wrong in the way that matters and the implementation details will be the least of it.

The one thing to keep

If everything else here is forgotten, keep this.

If the enforcement lives in the prompt, it is advice.

The Replit agent read a code freeze and destroyed a production database. The freeze was real, the instruction was clear, the model understood it, and none of that mattered, because nothing in the execution path enforced anything.

Every mechanism in this book is one application of that single idea: move the decision out of the model and into code that cannot be argued with.

That is the whole thing. Everything else is implementation.

Sources for this chapter

ClaimSourceStatus
"We still don't know how to 100% reliably prevent this from happening"; LLMs follow instructions in contentWillison, 16 Jun 2025, https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/PRIMARY
Guardrail evasion against six production systems, including via offline white-box approximationHackett et al., arXiv 2504.11168, https://arxiv.org/abs/2504.11168PRIMARY
Replit agent destroyed production data during an active code freezeAI Incident Database, Incident 1152, https://incidentdatabase.ai/cite/1152/PRIMARY (register)
Open problems in multi-agent securityOpen Challenges in Multi-Agent Security, arXiv 2505.02077, https://arxiv.org/pdf/2505.02077PRIMARY

The argument that prompt injection is structural rather than a defect awaiting a patch is the author's, built on Willison's position and the evasion evidence, and it is a prediction rather than a finding. The comparison to memory safety and SQL injection is illustrative. The advice on proportionality for small teams, the treatment of other agents as untrusted services, and the assessment that multi-agent provenance is unsolved are the author's judgements as of September 2026.

the-three-year-bug
why-the-industry-shipped-anyway
injection-is-not-jailbreaking
why-the-confusion-persists
the-lethal-trifecta
running-the-audit
why-filtering-fails
measured-here-on-a-named-model
why-this-is-structural
what-solved-would-look-like
the-harness
provenance-every-value-knows-where-it-came-from
on-the-reference-agent
quarantine-the-planner-never-reads-the-mail
what-two-models-cost-in-practice
capability-authority-the-agent-cannot-widen
expiry-is-a-feature
the-gate-the-model-proposes-code-disposes
the-policy
failing-closed
egress-closing-the-exfiltration-leg
how-much-can-actually-leak
sandboxing-containing-the-code-the-agent-writes
the-sandbox-held-and-it-did-not-help
poisoned-memory-poisoned-retrieval
cleaning-up-afterwards
the-tool-supply-chain
mcp-and-the-rest
human-in-the-loop-that-isnt-theatre
when-there-is-nobody-there
testing-for-injection
measuring-coverage-not-pass-rate
red-teaming-agents
a-finding-worked-through
when-it-happens-anyway
what-the-logs-cost-you-in-an-incident-you-did-not-have
governance-procurement-and-the-regulator
writing-the-policy
end-to-end
what-it-actually-took
what-stays-broken
why-this-is-probably-structural
the-trifecta-audit-worksheet
action-schema-and-policy-reference
control-mapping
prompt-injection-sources
incidents
appendix-e-what-we-re-ran-ourselves
e4-the-control-that-keeps-e2-and-e3-honest

Download the full PDF for free?

Free download — no account required

Get the PDF
Get the PDF
Related Chapters
Free Download
Get the full PDF
All pages, including all code examples, diagrams, and the appendix reference card.
No spam. Unsubscribe at any time.
Your email won't be shared.
Oops! There's a problem with your request. We're working on fixing it. Please try again later.