Agentic Prompt Injection

Direct and indirect injection of malicious instructions into an agent; LLMs cannot reliably distinguish information from instructions; defenses are spotlighting (50%→<2%), constitutional classifiers (95% blocked), input isolation, and attack-surface reduction — but a second IPI category, agent data injection, forges *trusted data* rather than instructions and slips past all of them