Prompt injection ends up being less about clever attacks and more about unclear boundaries. In practice, limiting what an agent can do at each step reduced risk more than trying to detect every bad prompt.