Every prompt is hostile input.

Start with the core clusters

Prompt injection, worked end to end: how the attacks are classified, how to catch them, how to test for them, and where the defenses fail.

• The prompt injection attack taxonomy — the five injection classes and the defense that maps to each. Start here for the full landscape.
• Indirect prompt injection — the class with no attacker in the session: delivery channels, attacker objectives, and what the published benchmarks measure.
• Detection techniques that actually work — the input- and output-side classifiers, and the documented bypass for each.
• Prompt injection testing — a repeatable method that produces a tracked attack-success number, not a pass/fail screenshot.
• Rebuff, reviewed — what its four detection layers catch, and the injection classes they structurally cannot reach.
• The layered defense guide — the control stack in implementation order, from text filters to privilege boundaries.