[TheTaytay]

I don't understand the part where you said that you have a very good handle on it. I really want to believe that it's as simple and solvable as you say it is. or do you mean that it's easily solvable - it's just that no one has done it yet? (In which case I think you are Simonw are saying the same thing?)

You mentioned the boundary between GET/POST args in a web app and a SQL query...but we have a system that is (by nature) mingling all of the parameters and execution together. It would be as if everyone's web server had a first line of their handler function that said something like "params = eval(user_based_params)", and you couldn't remove it...

[tptacek]

I think a pretty clear thru-line to the stories we're seeing about prompt injection and MCPs are agents that expose only a single context (or, at least, a single "logical" context) to their users: the untrusted data and the sensitive tool calls are coexisting within the same context window.