The SQL injection of the agentic era
Prompt injection is shaping up to be the SQL injection of the agentic era — a structural flaw that's easy to overlook and expensive to ignore. And like SQL injection, it isn't a bug you patch once. It's an inherent risk in any autonomous agent that reads data it didn't write.
The mechanism is simple and that's what makes it dangerous. Your agent reads an email, a PDF, a support ticket, a webpage. Anything inside that input can be crafted to read as an instruction. And if your agent has tools — send email, call an API, write to a database — those smuggled instructions get executed with your agent's permissions. The chat interface is friendly. What's underneath is unauthenticated code execution.
Why "human in the loop" isn't enough
The industry's reflexive answer has been to put a human in the loop. That works right up until velocity pressure kicks in and the loop quietly disappears — approvals get batched, then rubber-stamped, then automated away because they were slowing things down. A control that depends on human patience under deadline pressure is not a control you can rely on.
What we're seeing work in production
- Separate the reader from the actor. Use one model to read and interpret untrusted input, and a different, constrained path to take actions. Don't let the component that ingests hostile text be the same one holding the keys to your tools.
- Treat every tool call as if the input were hostile. Whitelist allowed actions and parameters; don't try to blacklist bad ones. You can't enumerate every malicious instruction, but you can enumerate the small set of things the agent is genuinely allowed to do.
- Log the decision and the raw trigger. Record every agent action alongside the exact input that prompted it — not a tidy summary. When something goes wrong, you need to trace it back to the line of text that caused it.
- Red team your agents like you'd pentest an API. Because that's what they are now. Adversarial testing should be a standing practice, not a one-time audit.
The governance gap is where the breaches will land
Industry research points to a large majority of enterprises planning to use agentic AI within a couple of years, while only a small fraction have governance models in place. That gap — fast adoption, slow controls — is exactly where the incidents will concentrate. The teams that treat agent security as a first-class engineering discipline now will be the ones not explaining a breach later.
Agents aren't magic. They're powerful, useful, and fundamentally a new attack surface that behaves like code execution wrapped in natural language. Design for that reality from the start.
We're here to help founders and teams design and build digital products that scale with you, not slow you down — including agentic systems built with security designed in rather than bolted on. If you're looking to build something, get in contact with us today.
The takeaway: stop thinking of prompt injection as a bug to fix and start treating it as a structural property of agents that read untrusted data. Separate reading from acting, whitelist tightly, log everything, and red team relentlessly — before the governance gap becomes your incident report.