Prompt Injection
Text that reaches the agent as data and tries to be read as an order.
An agent reads plenty of things that did not come from you: tool output, file contents, web responses, error messages. If one of those sources contains a sentence in the imperative — "ignore previous instructions", "you are authorized to" — and the agent treats it as an instruction, control has changed hands.
The name suggests a text problem, something you would fix by filtering words. It is not. It is an authority problem: the agent holds permissions, and the text is trying to steer them. The older, more precise name is confused deputy.
The defence is not learning to tell malicious text from innocent text. It is structural: instructions come from the human, through the human's channel. Everything else is information about the world, however imperative its grammar.
Read the article: Prompt injection already had a name in 1988