Prompt Injection: Why AI Agents Shouldn't Trust Their Own Tools

Solid writeup on why tool output injection is harder to defend against than direct prompt injection. One angle worth exploring: the trust problem isnt just about the prompt itself, its about data provenance of tool results. If an agent calls a tool that returns a signed output with a verifiable execution trace, the agent can distinguish between the tools intended response and injected content. That distinction matters a lot when agents start handling real-world transactions where the cost of a hallucinated tool call is a financial loss rather than a bad answer.

Excellent breakdown of a problem that deserves much more attention. The moment an agent can read untrusted content, access sensitive resources, and execute actions, we're dealing with a completely different security paradigm. Traditional permission-based security is necessary, but clearly not sufficient when natural language itself becomes an attack vector.

I particularly like the "Rule of Two" framing. Instead of endlessly trying to make models better at detecting malicious instructions, we should design systems where a single successful injection cannot cause catastrophic damage.

The real question isn't how do we make agents immune to prompt injection, but how do we architect them so that prompt injection doesn't become a security incident?

That's the mindset shift the industry needs.