Confused Deputy
A program with permissions is tricked into using them on someone else's behalf.
Norm Hardy named the problem in 1988. The original example is a compiler with write access to system files: ask it to write its output into one of them and it does, because the permission belongs to the compiler, not to whoever asked.
The program was not broken into and has no defect. It did exactly what it knows how to do, for the wrong party.
An agent is that kind of deputy. It carries tools, credentials and permissions that the text it reads does not have. Recognising that prompt injection is this same problem under a newer name changes where you look for the fix: in how authority is delegated, not in how text is filtered.
Read the article: Prompt injection already had a name in 1988