Why it matters
OpenAI treats prompt injection as contextual social engineering and uses source-sink analysis to connect attacker-controlled content with dangerous actions. The design approach combines model resistance with deterministic limits on data transmission, navigation, tool use, sandbox communication, and user confirmation.
My takeaway: Threat-model each agent workflow as a source-to-sink graph: mark every place untrusted content enters, every sensitive value the agent can read, and every external action or transmission it can trigger. Remove unnecessary paths, scope permissions, mediate dangerous sinks deterministically, show users the exact data and action at confirmation time, and test multi-step social-engineering cases.