That’s a great way to frame it. I completely agree, the real risk starts when an AI moves from generating text to actually interacting with tools and external systems. At that point, prompt injection becomes less about what the model says and more about what it can be tricked into doing. That’s also why I think least privilege, treating retrieved content as untrusted input, and validating tool calls are just as important as the model itself. The security boundary has to exist outside the model too. And yes, I’d treat retrieved document content as untrusted by default, just like user controlled input. The source may be legitimate, but its instructions shouldn’t automatically have authority.