Prompt injection is content in the agent's observations, such as a web page or a document, that is written to be read by the model as an instruction. The defence is architectural, not linguistic: treat every observation as untrusted data and gate side-effecting actions behind checks the model cannot talk its way past.