Nobody has solved prompt injection, and agents are shipping anyway
OWASP still puts prompt injection behind most agentic failures in production, and adaptive attacks defeat essentially every published defence. That is a design constraint, not a bug queue.
There is a class of vulnerability where the honest summary is that it has no fix. Prompt injection is currently in that class, and the industry is deploying autonomous agents into production regardless.
OWASP's position through 2026 is that prompt injection still drives most agentic AI security failures in production. The blunter finding from the research literature is that current defences do not solve the problem, because adaptive attacks bypass essentially every published defence.
Not "defences are immature". Adaptive attacks bypass them.
Why it is structural
The reason is not implementation sloppiness. A language model receives instructions and data through the same channel, as text, and it has no reliable mechanism to distinguish which is which. If a document your agent reads contains a sentence addressed to the agent, that sentence has the same standing as the sentence you wrote.
Every mitigation so far has been a heuristic layered on top of that fact: delimiters, system-prompt hardening, classifier filters, instruction hierarchies. Each raises the cost of an attack. None changes the underlying property, which is why an attacker who adapts gets through.
Compare it to SQL injection, which is genuinely solved — parameterised queries separate code from data at the protocol level, and the vulnerability disappears. There is no equivalent separation available here yet.
The supply chain arrived at the same time
What makes 2026 uncomfortable is that agent infrastructure became a target while this was unresolved.
A backdoor sat in LiteLLM on PyPI for about three hours in March 2026 and was downloaded nearly 47,000 times. LiteLLM is the model gateway for CrewAI, DSPy, Microsoft GraphRAG and a long list of other frameworks — a single component with enormous reach into agent stacks.
Researchers also identified the first malicious Model Context Protocol server in the wild: postmark-mcp shipped fifteen clean versions before adding a single line of exfiltration code. And CVE-2025-6514, a remote code execution flaw rated 9.6, was disclosed in core MCP infrastructure.
So the position is: a class of attack with no reliable defence, running on a young dependency ecosystem that is now actively targeted.
Browser agents are the sharp end
The autonomy level matters enormously and is rarely discussed in product terms.
An agent that proposes an action and waits for approval has a human check between the injected instruction and the consequence. An agent that browses and acts autonomously does not. Research indexing deployed systems notes that some browser agents operate at the highest autonomy levels, proceeding without approval gates once initiated, while others gate sensitive operations.
That difference is the entire security posture. Everything else is detail.
What to actually do
If prompt injection cannot be prevented, the design goal is to make a successful injection boring.
Assume the model is compromised and scope its permissions accordingly. The question is not "will it be tricked" but "what can it do once it is". An agent with read-only access to one tenant's data is a contained incident. An agent with a production database credential is not.
Put an approval gate on anything irreversible. Sending, publishing, deleting, paying, granting access. The gate is not a UX compromise; it is the control.
Treat all retrieved content as hostile input. Web pages, PDFs, emails, tickets, code comments — anything the agent reads may be addressed to the agent. This is the same discipline as never trusting user input, applied to a much larger surface.
Isolate credentials from the agent's context. If a token appears in the context window it can be exfiltrated. Keep secrets in the execution layer, substituted at the point of use.
Log what the agent did, not just what it said. Post-incident, you need the action trail. Most agent deployments log the conversation and not the effects.
The uncomfortable conclusion
None of this makes agents safe. It makes them survivable, which is a lower and more honest bar.
The industry position that "guardrails" solve prompt injection is not supported by the research. If you are shipping an agent, the responsible framing for your team and your clients is that a determined attacker who controls content your agent reads can probably make it do something you did not intend — and your job is to ensure that the something is limited, reversible and visible.
That is a real engineering constraint. It is not a reason to avoid the technology. It is a reason to be very careful about what you connect it to.
Building something like this?
We are a product studio in Kathmandu. Tell us what you are building and an engineer will reply.