Excellent breakdown of a problem that deserves much more attention. The moment an agent can read untrusted content, access sensitive resources, and execute actions, we're dealing with a completely different security paradigm. Traditional permission-based security is necessary, but clearly not sufficient when natural language itself becomes an attack vector.

I particularly like the "Rule of Two" framing. Instead of endlessly trying to make models better at detecting malicious instructions, we should design systems where a single successful injection cannot cause catastrophic damage.

The real question isn't how do we make agents immune to prompt injection, but how do we architect them so that prompt injection doesn't become a security incident?

That's the mindset shift the industry needs.