Prompt injection matters as soon as AI reads outside content and can take actions. An AI agent processing supplier emails could receive one containing hidden text that tells it to forward invoices elsewhere or change bank details.
No filter reliably catches every attempt, so the defense is in the design. Limit what the AI can access through least privilege, treat all outside content as untrusted data rather than instructions, require human approval for sensitive actions such as payments and log what the system does. The misconception is that a well-written system prompt prevents injection. It helps, but it is not a security control on its own.