The framework is the vulnerability

Prompt injection gets the headlines. The thing that decides what an injection can actually do gets almost no scrutiny at all.

OWASP's position is that prompt injection is unresolved at a fundamental level: a model processes everything as one token sequence and there is no mechanism to enforce privilege boundaries between system prompt, user query and retrieved content.

Why five years of mitigations have not converged

Every operating system built in the last forty years separates instruction from data at the hardware level. A transformer does not. Everything arrives in the same stream and the model decides what to obey by inference rather than by permission.

So every available mitigation is statistical. Better training, better filtering, better detection of suspicious content. Each reduces the rate. None establishes a boundary, and a boundary is what a security control is. A filter that works ninety nine percent of the time against an adversary who can retry indefinitely is a delay dressed as a defence.

Which is why the frameworks matter more

Researchers have disclosed nearly a dozen flaws, several critical, in the agent frameworks enterprises build on. An injection is only as dangerous as what the agent can subsequently do — and what it can do is entirely decided by the framework. Which tools are registered. Which credentials are in scope. Whether the sandbox is real.

Injection is the entry. The framework is the blast radius. The industry has spent its attention on the first and almost none on the second, and the second is the one you can actually fix, because it is ordinary software with ordinary boundaries.

The proof is already on the record

The frontier sandbox escape failed at the tooling layer too — a package installer with broader connectivity than intended. Not the model. The scaffolding. That is the same lesson arriving from a lab rather than a security vendor.

What follows

Enforce the trust boundary outside the model. Tool layer, network layer, operating system. Assume the model will be convinced of something and design so that being convinced is survivable.

Which is also why compiling governance rules into prompts is appealing and insufficient. A guardrail written into the context window is a strong suggestion competing with everything that arrives after it. Useful against accidents. Not a control.

The Register — Prompt injection isn't the bug, AI agent frameworks are → · Infosecurity Magazine — Prompt injection remains unsolved, OWASP researcher warns → · Unit 42 — Fooling AI agents: web-based indirect prompt injection observed in the wild →