OpenAI reframes prompt injection as social engineering against agents
OpenAI published guidance arguing that prompt injection cannot be solved by filtering suspicious text alone. The design approach focuses on constraining impact through trusted-source separation, restricted permissions, explicit confirmations and systems that treat instructions discovered in content as untrusted.
Why it matters: An agent reading email, webpages or documents faces the same structural problem as a person receiving a malicious request: the attacker can make a plausible instruction look relevant. The durable defense is limiting what a compromised decision can do.