Any system where a language model reads untrusted content and can also take actions has a security problem that does not have a clean fix. The model receives your instructions and the content in the same channel, and it cannot reliably tell which is which. Text hidden in a document, a support email, a web page or a code comment can instruct the model, and the model may follow it.
The consequences depend entirely on what the model can do. A system that only summarises text has a limited problem - the worst case is a bad summary. A system that can call tools, query databases, send messages or modify records has a serious one, because injected instructions inherit whatever access the model has. This is why the meaningful mitigations are architectural rather than textual.
Do not attempt to solve it with prompt wording. Instructions telling the model to ignore any instructions in the content it reads are worth adding and are not a control - they raise the effort required and do not stop a determined attempt. Treating them as a defence is the mistake that puts vulnerable systems into production, because it feels like it addressed the risk.
The controls that actually work reduce what an attacker can achieve if the model is subverted. Scope every tool to the minimum needed. Run as the invoking user rather than with service credentials, so the model can never touch data that user could not. Require human confirmation before anything consequential and irreversible - money moving, external messages, deletions - with the actual parameters shown, not a summary the model wrote. Separate the pipeline that processes untrusted content from the one with dangerous permissions.
Data exfiltration deserves specific attention because it is subtle. A model that can render images or links can be instructed to construct a URL containing information from its context and fetch it, sending your data to an attacker's server without any obvious action. Restricting outbound requests to an allowlist, and disallowing model-constructed URLs in rendered output, closes an avenue that prompt-level defences do not.
Test it deliberately. Include injection attempts in your evaluation set - documents with hidden instructions, support tickets containing directives, content designed to redirect the model - and check what the system does. And log every tool invocation with its arguments and the context that prompted it, because if something is exploited, the question will be what it did and with what, and reconstructing that from a conversation transcript afterwards is not possible.
