It is easy to think you have prompt injection figured out early on.
Everyone is talking about Prompt Injection, but 99% of founders are doing it wrong. I learned the hard way so you don't have to.
The Counterintuitive Truth
In prompt injection, the best practitioners often do less, not more.
The lesson: you should focus on one thing and do it exceptionally well. It sounds simple. It's incredibly hard to execute.
What I've Learned From 61 Companies
Across 234 angel investments, including Anthropic, a few patterns in prompt injection come up again and again.
The founders who handle prompt injection well understand that you need to move fast and break things.
Real Talk: What Actually Matters
Here is what actually matters in prompt injection.
First, execution speed beats perfection. Every time. Companies rarely fail because they moved too fast on prompt injection. Many fail because they moved too slowly.
Second, measure everything. If you can't measure it, you can't improve it. Set up tracking from day one, even if it's basic.
Third, talk to your users. It sounds obvious, but many founders make decisions about prompt injection in a vacuum. Get out of the building. Talk to real people.
This connects to broader themes around AI phishing, AI cybersecurity, zero-day AI, AI threat detection that I've been thinking about a lot lately.
What's Next
Best practice in prompt injection is changing fast. What worked last year might not work next year. That's both the challenge and the opportunity.
My advice: stay curious, stay humble, and stay close to the people who are actually doing the work. Read less thought leadership and do more experiments. Talk to fewer consultants and more practitioners.
If you're building in this space, the best time to get prompt injection right is before you need to. Don't wait for a crisis to force your hand.
I'll keep sharing what I learn. This stuff matters too much to keep to myself.
Frequently Asked Questions
Q:How were these items selected?
Each item on this list comes from direct experience, either from building my own companies or from patterns I've observed across the 234 startups I've invested in. I prioritize practical, actionable items over theoretical concepts.
Q:How do I know which items apply to my situation?
Start by honestly assessing where your biggest bottleneck is right now. The items that address that specific constraint will give you the highest return on your time and energy.
Q:Can I implement all of these at once?
I'd strongly recommend against it. Pick the 2-3 items that resonate most with your current situation and focus there. Trying to do everything simultaneously is a recipe for doing nothing well.
Q:Are these recommendations still relevant in 2026?
Absolutely. While specific tools and tactics change, the underlying principles remain consistent. I update my thinking regularly based on what I'm seeing in the market and across my portfolio companies.