What fails
Prompt injection is often explained as a user tricking a chatbot.
That framing is too small.
The real failure appears when hostile instructions enter a system that has access to private context, retrieval sources, tools, memory, workflow actions, or privileged prompts. At that point, the issue is not just bad output. It is untrusted instruction crossing a trust boundary.
The question is not whether the model can be fooled.
The question is what the model can touch after it is fooled.
How it shows up
A retrieved document tells the model to ignore previous instructions. A support ticket includes hidden instructions. A web page poisons an agent's browsing context. A customer upload alters the assistant's behavior. A prompt asks the system to reveal hidden context. A tool-using agent receives a malicious instruction that changes the action it chooses.
These are not science fiction scenarios. They are normal consequences of mixing language instructions with untrusted content.
Why teams miss it
Teams miss it because the demo still works.
The assistant gives useful answers. Retrieval improves quality. Tool use feels powerful. The injection path only becomes obvious when someone asks which content is trusted, which instructions are allowed to affect behavior, and which actions the model can trigger.
Most teams do not ask early enough.
Business impact
For a vendor, prompt injection becomes a buyer trust issue when the system handles sensitive data, enterprise workflows, or customer-facing decisions.
A buyer may ask:
Can untrusted content change model behavior?
If the answer is vague, trust drops.
Controls that matter
Useful controls include source trust classification, instruction hierarchy, retrieval sanitization, tool isolation, output constraints, abuse testing, sensitive action approvals, and logs that show what context influenced the model.
Prompt text alone is not a control strategy.
What good looks like
Good looks like a system that assumes untrusted content will attempt to instruct the model.
The design separates data from authority. Retrieved content can inform an answer, but it should not silently change tool permissions, system behavior, or approval requirements.
Recommended next step
Start with an AI Product Security Assessment if the system is customer-facing.
Use Agentic Workflow Hardening if prompt injection can influence tools, approvals, or workflow actions.