Analysis · curated 13 Jul 2026
Prompt Injection Is a Confused-Deputy Problem We Already Solved
First reported falshaw.de
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Reframing prompt injection as an unpatchable confused-deputy authority problem steers defenders toward containment and least-privilege architecture rather than model-level filtering that attackers can always bypass.
Nick Falshaw argues that indirect prompt injection against AI agents is a classic confused-deputy problem — a trusted agent with real authority tricked into misusing it by attacker-supplied content it cannot distinguish from legitimate instructions — and that it cannot be fixed by making models smarter, only contained with network-security-style boundaries. The piece draws on a 2026 study (arXiv:2605.17634) finding direct prompt injection succeeded over 79% of the time against browser agents and Simon Willison's 'lethal trifecta' framing.