LLM Agent Security: Prompt Injection, the Lethal Trifecta, and Defenses That Actually Work

A practical guide to the number one vulnerability in the OWASP Top 10 for LLM Applications: why prompt injection cannot be patched the way SQL injection can, the difference between direct and indirect injection, and the lethal trifecta threat model (private data + untrusted content + external communication) as a tool for auditing what your agent can call. Covers six defense layers with production-ready code: random-id delimiting and spotlighting, real least privilege using end-user permissions and the tenant_id-as-model-argument mistake, egress control against Markdown image exfiltration with allowlists, CSP and network policy, per-action human approval with summaries rendered from validated arguments, the Dual LLM / CaMeL pattern that makes the trifecta impossible by construction, and blast radius containment with sandboxing and short-lived credentials. Includes adversarial evals in pytest with an ASR budget in CI, the canary trick, eight recurring mistakes (RAG index poisoning, third-party MCP servers, classifiers as the only barrier) and an eleven-point production checklist.