It's the top security risk for agents that browse the web or call tools: untrusted data can carry commands ("ignore previous instructions and…"). For agentic systems this is serious because agents act — they can send data or make purchases.
Mitigations include treating tool/web content as untrusted, constraining what tools can do, requiring confirmation for sensitive actions, and clear auth boundaries on MCP servers.
Because agents take actions, not just answer. An injected instruction can cause an agent to exfiltrate data or make a transaction, not merely say something wrong.