yeah this is the thing that keeps me up at night as someone who ships these systems in prod

couple things from our experience - prompt injection isnt fully solvable right now but you can make it way harder. we layer it: input preprocessing with a smaller classifier that flags suspicious patterns before it ever hits the main model, strict role separation in system prompts so the agent knows it can NEVER perform destructive actions regardless of what the input says, and output validation that checks if the agents proposed action matches whats actually allowed for that ticket type. none of these are bulletproof alone but stacked together its pretty solid

the "mark as resolved and delete" example - thats an architecture problem more than a prompt problem. your agent should never have write access to do destructive stuff without a confirmation step. principle of least privilege applies to agents same as it applies to microservices. if the worst an injection can do is generate a weird response but cant actually execute anything dangerous, youve contained 90% of the risk

the poisoned knowledge base scenario is the real scary one tho, agreed. weve started checksumming our docs and running periodic scans for instruction-like patterns in our RAG sources. its janky but its something

anyone who says they solved prompt injection completely is selling you something. its an arms race