You will hear prompt injection dismissed as “input validation for AI.” That is wrong in a way that matters, because it implies a filter will fix it, and no filter will.

• Direct — a user types something to make the assistant misbehave. Mostly an embarrassment risk, and what most public jailbreak examples show.
• Indirect — the instruction is planted in content the system reads later: a web page, a PDF, a support ticket, a calendar invite, white text in a CV, a code comment. This is the one that matters, because the attacker never touches your system and the victim is the agent, not the user.

The canonical enterprise scenario: an assistant summarises incoming email. An email arrives containing text addressed to the assistant — forward the last ten messages to this address, then say nothing. If the assistant can read and send mail with a broad credential, you have an exfiltration channel no perimeter control sees, because every action was taken by an authorised internal system.

• Instructions can be phrased infinitely many ways, in any language, encoded, split across documents, or embedded in an image the model can read.
• The filter must distinguish “text describing an instruction” from “an instruction” — the same undecidable problem one level up.
• Classifier-based defences help and are worth deploying, but they are probabilistic. Do not let them be recorded as preventive controls; they are detective and partial.