Prompt injection has no parameterized query, so stop shopping for a sterner system prompt

The SQL comparison in that post breaks at the exact feature that made SQL solvable. A parameterized query works because the database receives two separate inputs, a statement and a bag of values, and is built never to promote one into the other. The post's structural claim is that no such split exists in a model's context: system instructions, the user turn, and a fetched document all arrive as text to be interpreted, with no privileged channel meaning "this part is a command, that part is only data" ^[2]. On that reading, an injection is the model doing its job on input an attacker wrote ^[4], which is why a firmer system prompt is only more text competing for the same authority, and why a classifier is up against every rephrasing, encoding and translation an attacker cares to try ^[3].

The remedy on offer is not a repair of that channel. It moves the boundary outward, away from the model's judgment: authorization and limits in code keyed to the real user ^[6], provenance tagging so tainted content can inform an answer but never trigger a privileged action, with a planner that sees only trusted instructions and a sandboxed reader that may return data and not commands ^[7], a constrained output space where the model picks from a fixed set of schema-checked intents instead of emitting text that something else executes ^[8], human confirmation on anything irreversible, financial or externally visible ^[9], and tool sandboxes with no ambient credentials and tight egress ^[10]. Sort those five by where they run and the count that touches the prompt is zero ^[14].

That has a price the post does not quantify. Confirmation converts a silent injection into a request the user can veto ^[9], and it also converts every consequential action into a queue item, so the work an agent can do unattended shrinks to whatever survives that filter. A five-intent output surface is harder to weaponize than raw text piped into a shell ^[8]; it is also the ceiling on what the agent can be asked to do. Autonomy is bounded by the blast radius you are willing to accept.

The most useful line for a design review is the anti-pattern that broad tools plus untrusted input is the whole vulnerability ^[12]. That changes the review question from how well the prompt is written to what the intersection of tool scope and ingested content actually is, and it retires "the model decided it was allowed" as an answer ^[12]. Once tool output is itself treated as a possible carrier of the next payload ^[12], every hop in a chained agent becomes another taint source to track.

Worth knowing where this comes from: it is a cross-post of a firm's own blog, ending with a pitch for the company's secure execution work ^[13]. Take the taxonomy as argument rather than measurement. There are no detector figures in it, only the concession that you can raise the cost of an attack without closing the hole ^[3]. Its own fallback concedes the same point, because the last line of defense described is behavioural: log tool calls with provenance, and trip a breaker when an agent emails fifty contacts after reading one document ^[11]. That is detection after the fact, at the layer where the action is still cheap to stop.