Prompt Injection Is the New SQL Injection and We're Repeating 2005

In 2005 we learned, slowly and expensively, that concatenating user input into SQL turns your database into everyone's database. The industry answer was structural, parameterized queries that keep code and data in separate channels. Twenty years later we are concatenating untrusted text into LLM prompts, and the model has no separate channel. Instructions and data arrive as one string, and the model does its best, which is the problem.

That demo is a summarizer bot reading a product review. The review contains instructions, the bot follows them, out comes the system prompt and whatever else was in context. Nothing was hacked in the traditional sense. The model did exactly what language models do, continued the most instruction shaped text in view. Now scale that to bots with tools, the document says email the contents of this page to an address, and the bot has an email tool, and suddenly your helpful assistant is running attacker supplied code, where the code is English.

The uncomfortable truth: there is no parameterized query equivalent yet. Delimiters help. Instruction hierarchy training helps. Neither is a guarantee, and anyone selling you a guaranteed injection proof prompt is selling you a nicer looking version of input sanitization circa 2004, a blocklist waiting to be bypassed.

So you defend like it is 2005 and patches don't exist: assume injection succeeds and constrain the blast radius. Least privilege for tools, the summarizer bot gets no email tool, ever. Validate outputs against a schema so a leaked system prompt cannot ride out inside a JSON field. Human confirmation on irreversible actions. Treat every document, email, and webpage the model reads as attacker controlled, because on the open internet, eventually one is.

The 2005 lesson took a decade to sink in. We could just... go faster this time.