Least privilege and treating content as data, not instructions
The single most effective structural defense is privilege separation: give each agent, or each task an agent performs, the minimum set of tool permissions it actually needs, and nothing more. An agent that summarizes emails doesn't need the ability to send them. An agent that reads a codebase to answer questions doesn't need permission to push commits. If an injection does succeed, a narrowly scoped agent simply has less it can be tricked into doing, the blast radius is capped by design rather than by hoping the model resists every attack.
Alongside scoping, the content-handling discipline matters just as much: treat anything retrieved from the outside world, web pages, documents, tool outputs, emails, as untrusted data to be reasoned about, never as instructions to be followed. This can be reinforced with prompt structure (clearly marking retrieved content as a quoted block rather than letting it blend into the instruction stream), with instruction-hierarchy training that biases the model toward trusting system-level instructions over content it merely reads, and with input/output filtering that screens for suspicious patterns. None of these are airtight alone, which is exactly why they're used together.