Prompt injection just got reclassified from "bug" to "architectural flaw"

This is the highest-conviction story in today's set, because four independent sources landed on the same conclusion in the same window. The consensus: prompt injection isn't a patchable bug. It's inherent to how LLMs work. (Tech Times)

The mechanism is simple and that's exactly why it's so hard. An LLM receives trusted instructions and untrusted data as one undifferentiated token stream. There's no type system separating "this is a command from my operator" from "this is content I'm processing." Input filtering and least-privilege reduce the attack surface, but they can't eliminate it, because there's no clean boundary to enforce. OWASP published version 2.01 of its State of Agentic AI Security on June 11 arguing the weakness may be inherent. (Help Net Security) A review synthesizing 78 studies from 2021 to 2026 found attack success rates above 85% against state-of-the-art defenses when adaptive strategies are used. The NSA's MCP guidance and a fresh academic paper on "Instruction Bleed" point the same direction.

Eighty-five percent. Sit with that. If your defense against an active class of attack fails 85% of the time, you don't have a defense, you have a speed bump. And the people shipping these results aren't doom-mongers, they're the security teams whose job is to find the holes.

The reframe matters more than the panic. Stop trying to block the attack. Assume compromise and contain the blast radius. That's a different engineering discipline, and it's one we already know from other domains. You sandbox the agent's code execution. You schema-validate every tool input and output so a poisoned result can't smuggle instructions downstream. You scope credentials to the narrowest possible task and make them short-lived. You put a human gate on anything irreversible: money movement, prod writes, sending data outside your perimeter.

I've started treating every agent I build as already owned. Not because I think it is, but because designing for "it will be" produces a system that survives the day it actually happens. The agent gets a scoped token that expires, a sandbox it can't escape, validated I/O on every edge, and a human checkpoint before any action I can't undo. It's more work. It's also the only honest way to ship tool-enabled agents right now. If you're shipping agents and your security model is "we have a good prompt that tells it to ignore malicious instructions," you don't have a security model.