Prompt Injection Has No Patch, So Price It Instead

Security programs process prompt injection as a vulnerability. It gets a severity rating, a remediation owner and a target date, and the expectation is that at some point it closes.

‍

It will not close. Instruction and data travel through the same channel in a language model, there is no syntactic separation equivalent to a parameterized query, and every proposed fix either fails against a sufficiently creative attacker or breaks the capability the system was built for. Treating a permanent architectural property as an open finding produces a register entry that ages indefinitely and a control conversation that goes nowhere.

‍

Why No Patch Is Coming

‍

The mechanism is structural rather than a defect in any particular implementation. A model receives a context window containing system instructions, user input and retrieved content, and processes all of it as language with the same semantic standing.

‍

Traditional injection defenses rely on separating the channel that carries instructions from the channel that carries data, which is what parameterized queries do for databases and output encoding does for web pages. No equivalent exists here, because the whole value of the system is that it reasons over content expressed in the same medium as its instructions.

‍

Filtering Fights the Purpose

‍

Sanitization works in conventional applications because the stripped characters carry no meaning for the user. Aggressive filtering of natural language removes exactly the content the system was asked to reason about, and retrieval quality degrades in proportion to how thoroughly the filtering is done. The more effective the filter, the less useful the application.

‍

Injections Do Not Have to Be Visible

‍

Instructions can be carried in whitespace, zero-width characters, text colored to match its background or document metadata a reader never sees. A person reviewing the source document finds nothing unusual because there is nothing for them to find, while the model reads every character it is given. Human review of inputs is therefore not a control against this, and programs that list it as one have documented something that does not work. The same channel carries regulated data into these systems in the other direction.

‍

System Prompts Are Configuration, Not Security

‍

Instructing a model to ignore contrary directions in retrieved content is worth doing and is not a control. It raises the effort required and provides no boundary, because the instruction and the attack occupy the same channel and the model weighs both.

‍

The same reasoning applies to any defense living inside the model's context. Guard prompts, delimiters and instructions to distrust external text are all subject to being overridden by sufficiently persuasive text, since persuasion is the medium. Controls that operate outside the context window behave differently, and the distinction between a stated scope and an enforced one has been demonstrated at the frontier rather than argued in theory.

‍

The Useful Question Is Blast Radius

‍

Once elimination is off the table, the governance question changes from whether the model can be manipulated to what follows when it is. The scope question has definite answers.

‍

An injected model with no tool access produces bad text. One with a search tool produces bad text informed by bad sources. One holding write access to a ticketing system, an email client or a payment instruction produces actions. The exposure differs by orders of magnitude across those cases and none of the difference comes from the model or from how well the input was filtered. Chains compound it, since one agent's output becomes another's trusted input.

‍

Scope Is the Only Control That Holds

‍

Narrowing what the model can reach, enforcing permissions at the target system rather than in the agent, and separating the component that plans from the component that executes all constrain outcomes regardless of what the model was convinced to attempt. Permission scoping does more work here than any input-side measure, and it is the measure most programs underinvest in.

‍

Put It on the Register as a Condition

‍

An unfixable property gets different treatment from an open finding. Organizations already know how to do this, because they carry other conditions they cannot remove, from third-party concentration to regulatory exposure in a given market.

‍

What the Entry Should Contain

‍

A named owner, since a condition without one drifts. A stated scope covering which systems ingest untrusted content and what each can reach, because that is what determines the exposure. A modeled figure rather than a severity band, so it can be compared against the cost of narrowing scope. A re-test cadence completes it, because model behavior changes and so does the set of tools each system holds.

‍

Reassess on Scope Change, Not on Schedule

‍

The exposure moves when someone grants an agent a new tool or connects a new data source, which happens between assessments and without a security review. Treating a scope change as the trigger produces a control that tracks reality, and periodic testing misses precisely these intervals.

‍

What Reduces Exposure in Practice

‍

Three measures produce most of the available reduction and all operate outside the model.

‍

• Least Tool Access: Grant the narrowest set of capabilities the task requires, and remove write access where read access suffices.
• Enforce at the Target: Let the receiving system check permissions on the presented identity rather than trusting the agent to respect a boundary.
• Separate Plan From Execute: Have one component propose and a narrower one carry out, with a check between them.

‍

Detection completes the set and is worth less than the three above, since an injection that succeeds has already produced its effect by the time anything alerts. Its value lies in bounding the investigation afterward, so recording what each agent did and under whose authority is a forensic investment rather than a preventive one. Behavioral monitoring in production provides that record.

‍

Testing It Without Overclaiming

‍

Adversarial testing for this class is worth running and worth interpreting carefully. A suite that fails to breach a system establishes that those particular attempts failed on that day against that model version, which is a narrower statement than passing implies.

‍

Recording the attempt count, the categories covered, the model version and the date turns a binary result into something comparable later. Re-running the same suite after a provider updates the model is where the value concentrates, because that is when a previously blocked technique can start working without anything changing on your side.

‍

Manage It Like a Condition You Keep

‍

Prompt injection is a property of how language models work rather than a defect awaiting a fix, and the defenses that live inside the context window are configuration rather than controls. What remains available is bounding the consequences, which makes tool scope, target-side enforcement and the separation of planning from execution the measures that matter. Carrying it on the register with an owner, a modeled figure and a scope-change trigger is how an organization holds a risk it cannot close. Kovrr's AI risk quantification produces the figure that makes narrowing scope a comparison rather than an argument.

‍

To see which of your AI systems ingest untrusted content and what each one can reach, book a demo mapped to your own estate.