What is prompt injection?

An attacker hides malicious instructions inside the text the LLM reads, causing it to perform unintended actions.

How does indirect injection differ from direct?

Direct injection is typed by the user; indirect injection hides instructions in external data that the agent fetches.

Can an agent write malware?

Yes—if it receives a prompt that instructs it to write code, it will write it.

Are DEP, ASLR, and stack canaries sufficient?

They reduce risk but do not eliminate prompt injection. Isolation is essential.

What is the best isolation strategy?

Run each agent in a separate VM, give it only read-only access to code, and review any changes before deployment.

Why is this still unsolved?

The LLM’s internal embedding merges prompt and context, so it cannot reliably distinguish malicious from benign text.

What about AI vendors?

They acknowledge the problem and are continuously improving defenses, but the attack surface will keep expanding.

How AI Agents Turn Into Threats: Guarding Your Code From Prompt Injection

Table of Contents

TL;DR

AI agents merge code and data, blurring the boundary that lets attackers inject malicious prompts.
Indirect injection sneaks in through untrusted web content or code comments, so there’s no visible user click.
Standard memory defenses (DEP, ASLR, stack canaries) are only mitigations; they don’t eliminate the risk.
The most reliable protection is isolation—run each agent in its own VM, keep it from credentials, and manually review any code it writes.
Even the biggest vendors (Microsoft, OpenAI) admit prompt injection remains unsolved for years.

Why This Matters

I’ve spent the last decade building production systems that rely on LLM-powered agents. One afternoon I noticed a log entry that said "Agent copied sensitive data to the inbox." I thought it was a bug until a security audit revealed the agent had been fed a malicious webpage that included a hidden instruction to do exactly that. Prompt injection had turned a helpful assistant into a data exfiltration tool.

The stakes are high. A single malicious prompt can make an agent:

Leak private files
Write malware on the host
Encrypt everything for ransomware

When I was on the call with my security team, we realized that the current defense stack (DEP, ASLR, stack canaries) only makes it harder for an attacker, not impossible. The underlying problem is the von Neumann architecture: code and data share the same memory, so the LLM cannot tell a malicious instruction from normal data.
Microsoft — What’s next in AI: 7 trends to watch in 2026 (2025)

Core Concepts

The Von Neumann Trilemma

The von Neumann architecture, which almost every modern CPU follows, keeps code and data in the same address space. This was a brilliant idea for flexibility, but it also means that if an attacker can inject data that looks like code, the processor (and the LLM) will happily execute it. Wikipedia — Von Neumann architecture (2025)

Remote Code Execution Is Still a Reality

Because of that shared memory, almost every classic buffer-overflow or use-after-free bug turns into a remote code execution (RCE) vulnerability. The LLM’s embedding matrix—its huge internal vector representation—merges prompt text with contextual data, erasing the distinction that a traditional compiler would keep. OpenAI — Understanding prompt injections (2025)

Direct vs. Indirect Prompt Injection

Direct injection happens when a malicious user types instructions directly into the chat. Indirect injection happens when the agent fetches external content—web pages, GitHub repositories, email attachments—that contain hidden instructions. Since the agent is trusted to read that content, the malicious prompt slips through the cracks. SentinelOne — Indirect Prompt Injection Attacks (2025)

Classic Mitigations: Not Enough

Mitigation	What it Does	Limitation
Data Execution Prevention (DEP)	Marks memory pages as non-executable	Only stops direct code execution; prompt-based data can still be interpreted
Address Space Layout Randomization (ASLR)	Randomizes code locations	Relies on luck; sophisticated agents can adapt
Stack Canaries	Detects stack overflows	Bypassed by embedding malicious data inside the context

Microsoft — Data Execution Prevention (2025) Microsoft — Address space layout randomization (2025) SANS — Stack canaries (2025)

How to Apply It

Isolate each agent in its own virtual machine. I run a Linux VM inside QEMU on an Intel-based Mac Mini for every agent. If one leaks, the rest stay safe.
Never give agents live GitHub or cloud credentials. I clone repositories locally and let the agent write changes, then I review them before pushing.
Use static analysis and manual review. Automated linters catch obvious code but not hidden prompts in comments or README files.
Turn on DEP, ASLR, and stack canaries in the host OS. They add layers of defense, even if they’re not perfect.
Monitor outbound traffic. A sudden spike to an external IP is a red flag that an agent may be exfiltrating data.
Keep the agent’s libraries up to date. Open source libraries can contain malicious prompts in comments that are easy to miss.
Accept that prompt injection is unsolvable for now. VentureBeat — OpenAI admits prompt injection may never be fully solved (2025) Plan for long-term mitigation: policy, code review, and continuous monitoring.

Pitfalls & Edge Cases

User Confirmation Fatigue: Repeated prompts asking “Did you mean this?” can annoy users and cause them to ignore warnings.
AI Vendors’ Patch Cycles: They’ll keep adding mitigations, but attackers adapt faster. Expect a cat-and-mouse cycle.
Indirect Injection Without User Interaction: A malicious webpage can be fetched automatically by the agent; no user click required.
Malvertising: Legitimate ads can carry malicious code that triggers a prompt injection when the agent parses the page. Imperva — What is Malvertising (2025)
Malicious Prompts in Open Source Code: Comment blocks and README files can hide instructions that the agent will obey. Medium — LLM Prompt Injection: real attacks, why detection is hard (2025)

Quick FAQ

Question	Answer
What is prompt injection?	An attacker hides malicious instructions inside the text the LLM reads, causing it to perform unintended actions.
How does indirect injection differ from direct?	Direct injection is typed by the user; indirect injection hides instructions in external data that the agent fetches.
Can an agent write malware?	Yes—if it receives a prompt that instructs it to write code, it will write it.
Are DEP, ASLR, and stack canaries sufficient?	They reduce risk but do not eliminate prompt injection. Isolation is essential.
What is the best isolation strategy?	Run each agent in a separate VM, give it only read-only access to code, and review any changes before deployment.
Why is this still unsolved?	The LLM’s internal embedding merges prompt and context, so it cannot reliably distinguish malicious from benign text.
What about AI vendors?	They acknowledge the problem and are continuously improving defenses, but the attack surface will keep expanding.

Conclusion

If you’re building or maintaining AI agents, the message is clear: don’t treat them as trusted black boxes. Treat them like any other software component that can run arbitrary code. Isolate, monitor, and review. The industry’s best mitigations (DEP, ASLR, canaries) are only the first line of defense; the real protection comes from design choices that limit an agent’s reach and human oversight.

Actionable next steps

Spin up a dedicated QEMU VM for each agent.
Remove GitHub credentials from the VM; use local clones.
Enable DEP, ASLR, and stack canaries on the host.
Implement an approval pipeline for any code generated by an agent.
Stay up to date on vendor security advisories—OpenAI, Microsoft, Google.

Who should and shouldn’t use AI agents?

You should if you can enforce isolation, review, and monitoring.
You shouldn’t if you rely on default settings or cannot audit the agent’s output.

Remember: Prompt injection is not a new bug; it’s the design flaw of mixing code and data in a single embedding matrix. Until we can enforce a hard separation, security teams must stay vigilant.