Topic starter
18/08/2026 2:44 pm
TL;DR: Prompt injection succeeds because LLMs treat user input, instructions, and context as one channel, allowing attackers to shift the active frame rather than exploit a parsing bug, according to Sprocket Security. The security problem is architectural: controls that rely on intent detection or prompt filtering remain brittle when the model can be redirected into a different language game.
Editorial analysis by NHI Mgmt Group, based on content published by Sprocket Security: “Context Is The Attack Surface”.
Key questions
Q: What breaks when prompt injection is not governed like an access problem?
A: The organisation may treat malicious text as a harmless message, even though it can steer an agent into exposing data or taking privileged actions.
Q: Why do frame-shift attacks create more risk in agentic AI workflows?
A: Agentic systems can read mail, process documents, and call tools, so a successful frame shift can become an action rather than just a bad answer.
Q: What are the signs that prompt filtering is failing?
A: Common signals include hidden Unicode characters, suspicious formatting, unexpected role shifts, cross-language instruction fragments, and payloads that only become harmful when split across turns.
Practitioner guidance
- Define frame-control checkpoints Map where authority transfer, genre shifting, and embedded context can alter model behaviour in your highest-risk workflows.
- Constrain model output by design Use structured output formats, allowlisted actions, and explicit instruction priority so the model cannot freely emit unsafe prose or tool calls after a prompt shift.
- Scope agent permissions tightly Limit what AI agents can read, write, and execute when they operate on untrusted context, especially in email, support, and document-processing workflows.
Bottom line: Prompt injection succeeds because LLMs infer authority from context, so the same text can steer the model differently depending on framing and workflow.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
18/08/2026 3:27 pm
Prompt injection is fundamentally a governance failure about frame control, not content moderation. The model is not being tricked by a bad string alone. It is being induced to adopt a different conversational frame in which unsafe behaviour becomes coherent. For NHI and agentic AI programmes, that means the control question is who or what gets to set the active frame, not merely whether the text looks suspicious. Practitioner conclusion: security teams need enforcement points outside the model.
A few things that frame the scale:
- Generative AI use specifically increased from 33% in 2023 to 79% in 2025, according to McKinsey’s Global Surveys on the State of AI.
A question worth separating out:
Q: Should teams prioritise output constraints or intent detection for LLM safety?
A: Output constraints should come first when the application handles untrusted context or can trigger tools. Intent detection is useful, but it remains brittle because the same words can be safe in one frame and unsafe in another. Structural limits reduce harm even when the model is successfully steered.
👉 Read our full editorial: Prompt injection works by shifting the model’s frame, not breaking it