Every indirect prompt injection follows the same four-stage pipeline — placement, retrieval, interpretation, execution — and that pipeline is the actual answer to ‘how does this happen,’ not a list of clever attack strings. Here’s the mechanism, where it hides in ordinary agent traffic you already run, and the defenses that target each stage instead of hoping the model classifies intent correctly.
Prompt injection isn’t a prompting problem, so you can’t prompt your way out of it. It’s the same class as SQL injection: data from an untrusted source crosses into a control channel and gets executed as instructions. The web page your agent just fetched, the ticket it just read, the email in its inbox — all of it is attacker-controllable input flowing straight into the one component that can’t tell data from commands. Here’s the data-flow framing, why ‘ignore injected instructions’ can’t work, and the boundary that actually helps.