Prompt injection is not a prompt-writing problem_

OWASP and model-provider guidance agree on the uncomfortable point: untrusted pages, emails, files, and tool results can carry instructions intended for the model. A stronger system prompt cannot make that data trusted.

The risk appears when an agent can act. A malicious line in a document is annoying for summarization; it becomes material when the same agent can send mail, alter records, or execute code.

What changes in practice_

Contain untrusted content, restrict tools, validate outputs, require confirmation for consequential actions, and test attacks as part of evaluation.

• Separate data from instructions.
• Grant the minimum tools and scopes.
• Log and review consequential tool calls.

Our take_

The durable advantage is not adopting the newest tool first. It is building the identity, state, evidence, and operating boundaries that let a real team own the system after launch.