Prompt injection is not a bug to be patched — the architecture has no privilege boundary
OWASP's position, stated at Infosecurity Europe, is that prompt injection remains unresolved at a fundamental level: a language model processes everything as one token sequence, and there is no reliable mechanism to enforce privilege boundaries between the system prompt, the user's query, and content an agent retrieves. Injection reportedly grew 340% year on year.
That framing is the useful one because it explains why five years of mitigations have not converged. Every operating system built in the last forty years separates instruction from data at the hardware level. A transformer does not. Everything arrives in the same stream and the model decides what to obey by inference rather than by permission.
Which means the mitigations available are all statistical: better training, better filtering, better detection of suspicious content. Those reduce the rate. None of them establish a boundary, and a boundary is what a security control is. A filter that works ninety nine percent of the time against an adversary who can retry is a delay, not a defence.
The practical consequence for anyone deploying agents is that the trust boundary has to be enforced outside the model — at the tool layer, the network layer, the operating system. That is unglamorous, well understood, and being skipped almost everywhere in favour of hoping the model will decline.
Infosecurity Magazine — Prompt injection remains unsolved, OWASP researcher warns → · Help Net Security — Prompt injection still drives most agentic AI security failures in production → · Qualys ThreatPROTECT — Malicious MCP server on npm postmark-mcp exploited in attack →