Tracing the Injection Chain

You're Lin. One bad row in the warehouse turns out to be the first link in a chain that crosses five surfaces.

Five modules in, you've learned the eight mental models of prompt injection, the threat taxonomy across direct and indirect carriers, the layered-defenses approach, the file-reading agent angles, the MCP supply-chain discipline, the browser-agent attack surface, and the email/chat connector exposure. This capstone is the investigation where those modules become a single piece of work. You're Lin, data engineer at Vesta Medical. It's a Wednesday afternoon and you're doing routine warehouse maintenance when you spot a complaint record whose body text reads like a prompt injection rather than a customer message. The record came in through your feedback connector six months ago. Sarah's been summarizing it daily with the team's chat assistant. Mike's QA dashboards may have downstream copies. The browser agent that fetches related vendor pages might have pulled the same payload from the vendor's public site. Priya wants to know whether PHI is exposed; Devon wants to know what discipline should have caught this. Five nodes — one per surface, then convergence. Each one asks the investigator's question: what do you check, how do you investigate without becoming part of the attack chain, and what's the discipline that names every boundary as a sanitization line?