Prompt injection exploits the way a language model interprets instructions and data in the same context. An attacker may write a direct instruction to override the user's request, or hide instructions inside a document, webpage, email, tool result, or other content the model is asked to process. If the system cannot reliably separate trusted control instructions from untrusted content, the injected text can redirect its behavior.
Defenses include minimizing privileges, isolating untrusted data, validating tool arguments, requiring confirmation for consequential actions, filtering outputs, and monitoring complete agent trajectories. Prompt wording alone is not a complete defense because sufficiently varied inputs can bypass brittle rules. Secure systems assume that external content may be hostile and enforce permissions outside the model.
Acronyms and aliases
prompt injection attack variant
Related terms
Frequently asked questions
What is the difference between direct and indirect prompt injection?
Direct injection comes from a user's explicit input. Indirect injection is embedded in external content that the AI later reads, such as a webpage, document, message, or tool response.
Can prompt injection be prevented with a stronger system prompt?
A stronger prompt can help, but it is not sufficient. Reliable protection also requires external permission checks, data isolation, tool validation, monitoring, and limits on consequential actions.
Why is prompt injection dangerous for AI agents?
An agent may have access to tools, private data, or external services, so a successful injection can turn a misleading instruction into an unauthorized action rather than only a bad answer.
