When data and instructions are not clearly separated, documents themselves become attack surfaces. This post analyzes indirect prompt injection as an architectural failure in agentic AI systems.