Guardrails alone cannot prevent prompt injection

Products claiming to detect 95% of prompt injection attacks carry a failing grade in security. No solution reliably prevents an LLM from following instructions embedded in content it processes. The core problem is architectural: LLMs treat all input as potential instructions, and no classifier or prompt-level defense has proven robust against novel attack phrasing.

The productive approach is constraint, not detection. Once an agent has ingested untrusted input, it must be impossible for that input to trigger consequential actions. Six design patterns help: action-selector (fire tools without reading responses), plan-then-execute (lock the plan before exposure), dual LLM (privileged coordinator plus quarantined worker), and context-minimization (strip untrusted text before acting).