Claim
Prompt injection is widely treated as a security vulnerability.
This framing is incomplete.
Prompt injection is not primarily a model weakness, but a governance failure at the semantic level.
The misleading technical framing
Most defenses frame the problem as one of:
- malicious input
- insufficient filtering
- model susceptibility
Accordingly, proposed solutions focus on:
- input sanitization
- guardrails
- output constraints
These approaches assume the agent’s authority is already legitimate, and only needs protection from abuse.
This assumption is false.
The lethal trifecta as a structural condition
An AI agent becomes dangerous not because it is intelligent, but because it combines three capabilities:
- access to private data
- exposure to untrusted external content
- outbound action or communication ability
This combination is not an accident. It is a design choice.
Prompt injection succeeds because there is no institutional boundary between reading and acting.
The real failure: absence of semantic authority control
Language models lack a built-in distinction between:
- description and instruction
- data and command
- narrative and delegation
When architectures treat all language as potentially executable, authority becomes implicit.
The system does not ask:
- who is allowed to issue commands
- from which channel
- under what conditions
Execution emerges from fluency.
Why current defenses are structurally insufficient
Input filtering fails because language is generative. Guardrails fail because meaning bypasses surface constraints. Function calling restrictions fail because intent is inferred, not declared.
These defenses attempt to block attacks without addressing why the agent is authorized to act at all.
Prompt injection as unauthorized delegation
Seen clearly, prompt injection is a form of: semantic privilege escalation.
External text acquires the power of command without being granted authority.
This is not a bug. It is an ungoverned permission model.
Alignment does not solve this
Alignment techniques such as RLHF optimize behavior, but do not establish authority boundaries.
They train what the model should do, not what it is allowed to do.
Without explicit delegation logic, aligned agents remain structurally overpowered.
Position
Agent security cannot be solved by making models nicer, safer, or more cautious.
It requires:
- explicit semantic role separation
- authority declared, not inferred
- execution gated by institutional logic
Until language is treated as a governed interface, prompt injection will remain inevitable.
Closing
Prompt injection persists because systems confuse understanding with permission.
LLMs are not dangerous. Assigning them agency is.
The core risk of modern AI systems is not intelligence without control, but language systems deployed as agents without institutions.