Prompt Injection Cannot Be Cured by Filters: How to Isolate Untrusted Text Using Architectural Patterns

Prompt injection is a vulnerability where untrusted text (e.g., from a web page or email) enters an LLM's context and is executed as an instruction, leading to data theft or unauthorized actions. This is not jailbreaking: the attacker is another person, and the victim is a user who simply asked to process the content. Classic defenses—such as a system prompt saying "ignore other instructions" and input classifiers—do not work due to the infinite variety of attacks and model nondeterminism. A study titled "The Attacker Moves Second" (2025) showed that 12 published defenses are bypassed in over 90% of cases under adaptive attacks; a live red-teaming session bypassed all 100%. The vulnerability is explained by the "lethal trio": private data + untrusted content + an external channel. An example is EchoLeak (CVE-2025-32711) against Microsoft 365 Copilot: a zero-click exploit via email bypassed classifiers, link filters, Content Security Policy (CSP), and Retrieval-Augmented Generation (RAG). Meta proposed the "two-person rule": an agent should not simultaneously have access to data, process untrusted input, and change state or communicate with the external world. The Dual-LLM pattern splits functions across two models: the privileged model (with tools) does not see untrusted text, while the isolated model (with text) has no tools; a controller code passes only symbolic variables. Google DeepMind proposed CaMeL (Confidential Multi-Agent LLM), a system with encryption at the Role-Based Access Control (RBAC) level, where each agent is given only necessary roles, and untrusted data is marked and invisible to privileged agents. In 2025, six design patterns were published that systematize isolation depending on the task. A working implementation using three models that cannot see each other, with deterministic checks, is analyzed through the example of an FAQ generator that reads an external page but does not comply with its instructions.