Forget everything you know about Prompt Injection. The rules have changed, and this is the new playbook for surviving the AI era.
What I've Learned From 75 Companies
A few patterns in prompt injection come up again and again.
The founders who handle prompt injection well understand that your team matters more than your technology.
The Framework That Actually Works
Here is a simple framework for evaluating prompt injection. It's not complicated, but it requires discipline.
Step 1: you need to move fast and break things
This is where most people go wrong. They skip this step entirely and jump straight to execution. Don't do that.
Step 2: most founders overthink this and underspend on execution
Once you have the foundation right, this becomes much easier. I've watched founders struggle with this for months when the answer was staring them in the face.
Step 3: Iterate relentlessly
Nothing works perfectly the first time. The companies that get prompt injection right treat it as an ongoing process, not a one-time project.
What I Tell Founders
Before deciding anything about prompt injection, start with three questions:
What's your timeline? Because the right approach for a company with 6 months of runway is very different from one with 3 years.
What have you already tried? Most founders have tried something. Understanding what didn't work is often more valuable than knowing what might.
Who on your team owns this? If the answer is "everyone" or "no one," that's your first problem to solve.
These questions seem simple but they reveal a lot about where a company actually stands.
This connects to broader themes around AI threat detection, AI cybersecurity, zero-day AI, adversarial AI, AI phishing that I've been thinking about a lot lately.
What's Next
Best practice in prompt injection is changing fast. What worked last year might not work next year. That's both the challenge and the opportunity.
My advice: stay curious, stay humble, and stay close to the people who are actually doing the work. Read less thought leadership and do more experiments. Talk to fewer consultants and more practitioners.
If you're building in this space, the best time to get prompt injection right is before you need to. Don't wait for a crisis to force your hand.
I'll keep sharing what I learn. This stuff matters too much to keep to myself.
Frequently Asked Questions
Q:Do all experts agree with this view?
No, and that's fine. The best ideas in business are often contrarian. I share my perspective based on my experience and data, but I encourage you to seek out opposing viewpoints and form your own conclusions.
Q:What experience informs this perspective?
This perspective comes from over a decade of building companies in Silicon Valley, two successful exits (RemoteTeam to Gusto, MovieLaLa to Gfycat), and investing in 234 startups including Anthropic, OpenAI, and Scale AI. I write about what I've lived.
Q:How has this view evolved over time?
My thinking on most topics has changed significantly over the years. Early in my career, I held many conventional views that experience proved wrong. I try to update my beliefs when the evidence changes.