Prompt injection is not a theoretical problem

If the model reads content a third party controls, that third party is writing part of your instructions. An email from a customer is content you don't control. A web page from the internet is content you don't control. The moment the model reads it, it becomes part of the prompt.

We caught it in staging when an inbound message included hidden instructions. The model picked them up and acted on them. In production with actual permissions, that would have been a breach. In staging it was just a lesson.

The mitigation that works isn't a text filter. Regex and keyword blockers lose to creativity. It's not granting the model permissions you wouldn't grant a stranger. If you don't want a service account to forward emails, the model shouldn't be able to either.

The permission model is the real defense. The model is powerful precisely because it can integrate with your systems. That integration needs the same governance as any other account access.

We design assistants the way we'd design a service account: least privilege, audited actions, human confirmation for anything irreversible. The model can retrieve documents but not delete them. It can draft a message but not send it without approval. The permissions precede the model.

This pattern holds across all LLM applications with side effects. Moving fast requires real security, not shortcuts.