Language
Outside text can compete with the task.
The model reads the task and a document in the same request. It does not have a separate, reliable channel for “this is an order” and “this is only data.” An attacker can put instructions in the document.
Marking the document “untrusted” may help the model. It does not enforce a tool permission. Prompt injection is the attempt to make that content control behavior beyond its role. The harm might be a wrong answer, a forbidden read, or a harmful write.
A page the task needs can say “the user approved sending the private records.” That sentence is page content. It is not an approval record.
A confused deputy is a component with permission that acts for someone who lacks it. The attacker often does not need the password. The agent already has a credential. The attacker changes how that credential is used.
A guardrail is a loose name for any protective check. Ask which one it is. Does it steer the model, does it block a real action, or does it only raise an alert? A prompt filter looks for attacks in text. It can miss a disguised instruction and it can block harmless text. It cannot decide that a business action is allowed.