A language model writes twenty question-and-answer pairs for a product page in under a minute. The trouble starts right after. For the answers to be correct, the model needs the company's facts: prices, delivery times, warranty terms. For the questions to fit the page, it needs the page text itself. And the moment both sit in the same context window, every foreign page has a voice inside a system that knows the company's data and can call tools.
That is prompt injection. Not some exotic finding from a bug-bounty report, but a structural defect in how we glue context together today. In almost four years of public discussion, no cure has appeared. Something more useful has: engineering patterns that never try to tell "good" instructions from "bad" ones. Instead they build the system so that question stops mattering.
What follows is the threat model (the lethal trifecta and the rule of two), Simon Willison's Dual-LLM pattern, Google DeepMind's CaMeL, and six design patterns from a 2025 paper. At the end, a working implementation on three models that never see each other, with the code for the deterministic checks. The whole thing rides on one running example: a FAQ generator that reads a foreign page without obeying it.
