What exactly is prompt injection?

There are two flavours, and only one of them should keep you up at night.

Why is prompt injection still unsolved in 2026?

Because the defences are probabilistic and the attacker only has to win once.

Which prompt injection attacks have actually happened?

Not theory. Here are four documented cases from production systems, all disclosed and patched.

Why does MCP widen the attack surface?

The Model Context Protocol solved a real problem: connecting models to tools without writing a bespoke integration each time. It also standardised a new injection surface, because a tool description is text the model reads, and text the model reads is a place to hide instructions.

What defenses actually reduce risk?

None of these eliminate prompt injection. All of them make a successful injection cheaper to survive. Ranked by how much protection they buy per hour of work:

Prompt injection: what it is, and how to defend

Prompt injection has no patch. What it is, which attacks really happened, and how to scope AI agents so a successful hijack stays cheap.

Prompt injection is the bug you cannot patch. If a model reads text you do not control, and that model can then act (call a tool, send a message, open a pull request, query a database), whoever wrote that text gets a shot at steering it. No input sanitisation closes the hole, because the hole is the product: the model is built to follow instructions written in plain language, and it has no reliable way to tell which sentences came from you and which came from a web page it fetched thirty seconds ago. I get uneasy when a client tells me their agent is "secured by the system prompt". A system prompt is a request, not a boundary. Four years after Simon Willison named the attack in September 2022, the state of the art is still mitigation: shrink the blast radius, and assume the model will eventually be talked…