Prompt Injection Is Not a Joke

1. FMFront Matter: Prompt Injection Is Not a Joke—
2. INTIntroduction: The String in the Ticket16
3. 01The Ticket That Tried to Email Itself22
4. 02A Prompt Is Not a Security Boundary30
5. 03Assets, Trust Boundaries, and the TRUST Framework38
6. 04The Confused Deputy, Least Privilege, and Blast Radius46
7. 05Talking the Model Out of Its Instructions53
8. 06Input Handling: What Classifiers and Boundaries Can and Cannot Do60
9. 07The Supply Chain of Untrusted Text68
10. 08RAG Is an Attack Surface: Ingestion and Retrieval Defenses75
11. 09Read Tools, Write Tools, and the Argument Nobody Validated83
12. 10Capability Manifests, Tool-Call Gates, and Approval Flows90
13. 11The Many Doors Data Leaves By99
14. 12Secrets, Minimization, Canaries, and the Limits of Output Filtering107
15. 13When the Attack Outlives the Session115
16. 14Defense-in-Depth: The Whole Architecture123
17. 15Red Teams, Fixtures, and Tests That Load Malicious Documents131
18. 16Monitoring, Forensics, and the Injection Incident139
19. 17Ten Systems, Ten Threat Models, Ten Launch Checklists147
20. AAppendix A: Back Matter157

The full chapters, illustrations, and reference material are included in the downloadable PDF.