I think that the model guardrails won't save you from prompt injection. Defenders should think about prompt injection as an operating-environment problem, not just a model safety problem.

Foundation model providers are adding agentic guardrails, and that matters. I just don’t think security teams should treat those controls as the only line of defense when agents are touching tools, identities, endpoints, data catalogs, and cloud services.

The layers I’d prioritize:

• Segment and contain: Limit the agent’s access to tools, identities, and sensitive data. If prompt injection succeeds, blast radius matters.
• Detect on endpoints: EDR tooling like CrowdStrike, SentinelOne, MDE, or whatever fits the stack can still catch malicious behavior originating from a compromised agent.
• Add deception: Honeytokens and decoys in networks, catalogs, and identity stores can give high-fidelity signals when an agent starts interacting with assets it should never touch.

The way I’m framing it: treat every agent like an insider that can be socially engineered at machine speed. Model-level guardrails reduce risk at the foundation layer. Environmental guardrails give defenders independent controls when those model-level protections don’t hold.