4.6 Prompt Injection & the Lethal Trifecta¶

The one unsolved agent-security problem: direct and indirect injection, the trifecta of private data plus untrusted content plus an exfiltration channel, and what actually reduces the risk.

Also called: prompt injection, indirect prompt injection, the lethal trifecta, OWASP LLM01, goal hijacking (OWASP ASI01).

Stub: scaffolding, not finished writing · planned for a later release. The skeleton below shows the beats this chapter will hit. Contributions welcome.

Why you'd reach for it¶

The problem, what breaks without it, and when you need it. To be written.

What it actually is¶

A crisp definition, the maturity call argued with cited evidence, and how it differs from its neighbours. To be written.

How to do it¶

The mechanics, with public tools named plainly where the reader can verify them; code only where a tested listing earns its place. To be written.

Gotchas¶

The real costs and when not to, feeding the Anti-Patterns Catalog. To be written.

In short¶

A weighted recommendation: what you would actually do. To be written.

Maturity: Established (threat) / Contested (defenses) (the threat is settled; no defense is; least privilege and capability partitioning are what hold) · Grounding: research · Last reviewed: 2026-08

Sources¶

Citations added as the chapter is written. Every non-obvious claim gets a footnote.