Unlike SQL injection, there's no finish line yet
SQL injection is, for practical purposes, a solved problem: parameterized queries provide a robust, essentially complete fix, and a codebase that uses them consistently is not vulnerable to it. Prompt injection has no equivalent finish line. Every mitigation covered in this course, instruction hierarchies, content-marking, filtering, scoping, human review, reduces risk without eliminating it, because the underlying cause (an LLM inferring intent from a single undifferentiated stream of text) hasn't gone away. Researchers actively publish new injection techniques and new defenses in a continuing back-and-forth, which is the signature of an open problem, not a closed one.
This isn't a reason for despair, and it isn't unique to being unusually poorly engineered, it's a direct consequence of what makes LLMs useful in the first place: their ability to flexibly interpret natural language instead of requiring rigid, pre-defined syntax. That flexibility is exactly what makes rigid boundary enforcement, the kind that solved SQL injection, hard to bolt on without also compromising the model's usefulness. Being honest about this is what separates a security-mature agent deployment from one that's quietly hoping the problem doesn't apply to them.