Prompt injection is a data plane problem
One GitHub issue was enough to make a coding agent leak a private repo through the official MCP server. In January the Git MCP server fell to path traversal from a prompt alone. I don't think either was a model failure. Both were the mistake we made with SQL in 2004, sending data and instructions down the same wire.
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.