An NCSC technical director argued that prompt injection differs from SQL injection because LLMs do not separate data from instructions, so it should be treated as a residual confused-deputy risk rather than a patchable bug. The NCSC recommends deterministic safeguards that constrain system actions, dropping an LLM's privileges to those of the party whose content it is processing, and logging full inputs, outputs and tool calls.
Why it matters
A national cyber agency stating that prompt injection is inherent shifts agent security from filtering toward privilege and blast-radius design.
Key facts
As stated in the sources, with where to find them.
- Recommended design rule: when an LLM processes information from a party, its privileges drop to that party's level.Secure design recommendations
- Recommends logging full LLM inputs and outputs and tool/API calls, and cautions against deny-list approaches; references ETSI TS 104 223.Recommendations
- The blog states that if a system cannot tolerate the residual risk, it may not be a good use case for LLMs.Conclusion
Findings that cite this record
No tracked finding cites this record yet.
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.
Sources
Related records
Sep 30, 2025
Jan 8, 2026
Dec 9, 2025
May 1, 2026
Aug 3, 2026
Mar 24, 2025