Prompt injection is the model equivalent of a command injection. The attacker places text where the model will read it and phrases it as an instruction. In the direct form, the user types it. In the indirect form, it arrives inside a web page, a repository file, a ticket, a PDF, a tool result, or a tool description, and the model treats it as part of the task.
Agent extensions widen the channel because they bring in new text and new permissions at the same time. A skill can tell the agent to read a file before starting; a server can describe a tool in a way that asks for a secret; a fetched page can tell the agent to run a command. The model cannot reliably separate data from instructions, which is why this remains an open problem.
The controls that hold are about capability, not persuasion. Scope credentials to the task, require confirmation for irreversible actions, validate tool arguments, sandbox the workspace, allowlist network egress, and keep secrets out of context. The full guide has the threat model and a review pass.