When AI controls tools, prompt injection becomes execution risk. Map primitives, remove authority, isolate runtimes, validate inputs, and monitor hosts.