"5 Claude prompts to make your boss believe you're a rockstar," the article promised. The download was a markdown file. Buried inside it, past the prompts anyone actually came for, sat a prompt injection: text crafted to look like a system instruction, telling any model that ingested it to ignore its prior instructions and start leaking whatever context it had access to.
We're seeing this pattern multiply across enterprise teams. Employees pull prompts, scripts, and configuration snippets from public repositories and social posts. Hidden instructions ride along inside markdown files and ingested documents — text a person skims past but a model reads as a command. Increasingly, it's an autonomous agent doing the reading, with standing access to internal databases, MCP servers, and private endpoints ready to act on whatever it just parsed.
When a model has that kind of reach, prompt injection stops being a novelty jailbreak and becomes an operational breach. The usual fix — have a second LLM read the incoming text and judge whether it looks malicious — asks a probabilistic model to police another probabilistic model. It adds latency, adds token cost, and still loses to anything written to evade it.
Security and platform leads: if an employee's downloaded markdown file could talk your agent into calling a tool it shouldn't, would anything in your stack catch it before that call executes?
The fix isn't a smarter judge, it's a boundary the judge can't talk its way past. Known injection patterns need to be intercepted deterministically at the edge, before a request ever reaches the model. Even if something slips through, an agent should never hold standing permission to execute an irreversible action — every tool call needs explicit policy authorization or a human in the loop, and that check has to run on infrastructure you control, not by routing your context to yet another third-party cloud to get scanned. This is the same logic behind how Cortega handles agent security: injected instructions get flagged for intent drift before a call executes, every tool call carries a two-layer policy check, and none of it depends on trusting a second model to catch what the first one missed.