Prompt injection is permanent. Design around it.

Prompt injection isn't a bug you'll patch. It's a property of how the model reads, and OWASP's new report stops pretending otherwise.

The model sees the system prompt, the user request, and a retrieved document as one token stream. No boundary between instruction and data. That isn't a missing feature. It's the architecture. OWASP's "State of Agentic AI Security" v2.01 (June 11) maps injection to 6 of the 10 agentic Top-10 categories. You don't patch the foundation.

So stop filtering inputs and start budgeting capability. Two rules worth stealing:

• Lethal trifecta (Willison): private data + untrusted content + external comms. One agent holding all three is an exfiltration tool waiting for one poisoned input.
• Rule of Two (Meta): an unsupervised agent gets at most two of those three legs. Want all three? A human signs off. Full stop.

The trap: the trifecta is a property of the session, not the agent. A safe RAG read, a safe DB lookup, and a safe send-email tool each pass review, then co-occur in one context window and arm the bomb. Audit the composition, not the tools.

Guardrail classifiers lower the incidence. They don't close the class. You're always one encoding away.

Design the blast radius. Don't litigate the prompt.