Prompt Injection Is Not Cured by Filters: How to Isolate Untrusted Text Using Architectural Patterns

Prompt injection, introduced by Simon Willison in September 2022, occurs when untrusted text in an LLM's context is executed as an instruction. Unlike jailbreaking, it affects applications where the model has access to tools and data, leading to confused deputy and data exfiltration attacks. The article argues that system prompts and guardrail classifiers are ineffective, citing a 2025 study by OpenAI, Anthropic, and Google DeepMind that showed adaptive attacks bypass 12 published defenses with over 90% success. Simon Willison's 'lethal trifecta' identifies three ingredients for data exfiltration: access to private data, contact with untrusted content, and an outbound channel. The EchoLeak vulnerability (CVE-2025-32711) in Microsoft 365 Copilot exploited all three. Meta's 'Agents Rule of Two' states that an agent should have no more than two of three properties: processing untrusted input, access to sensitive systems/data, and ability to change state or communicate externally. Architectures like Dual-LLM (Willison, 2023) separate a privileged LLM (with tools, seeing only trusted input) from a quarantined LLM (with no tools, handling untrusted text), connected by a deterministic controller. Google DeepMind's CaMeL (2024) uses a verifier to enforce that the quarantined model outputs only a strict subset of allowed tokens. Six project patterns from a 2025 paper extend this idea. A concrete implementation is described using three isolated models for a FAQ generator: one privileged with access to company data and tools, one quarantined for untrusted page text, and one for synthesis, with deterministic checks between them.