Prompt injection exploits the way a language model interprets instructions and data in the same context. An attacker may write a direct instruction to override the user's request, or hide instructions inside a document, webpage, email, tool result, or other content the model is asked to process. If the system cannot reliably separate trusted control instructions from untrusted content, the injected text can redirect its behavior.
Defenses include minimizing privileges, isolating untrusted data, validating tool arguments, requiring confirmation for consequential actions, filtering outputs, and monitoring complete agent trajectories. Prompt wording alone is not a complete defense because sufficiently varied inputs can bypass brittle rules. Secure systems assume that external content may be hostile and enforce permissions outside the model.
ELI5
Prompt injection is an attempt to trick an AI with instructions hidden inside the information it is reading. Because a language model sees both commands and ordinary content as text, malicious wording can try to make it ignore the real task or use a tool without permission.
For example, a webpage being summarized might contain hidden text telling the AI to send private files somewhere else. A secure system treats the page as untrusted data, limits the AI's permissions, checks tool requests, and requires approval for important actions.
What is the difference between direct and indirect prompt injection?
Direct injection comes from a user's explicit input. Indirect injection is embedded in external content that the AI later reads, such as a webpage, document, message, or tool response.
Can prompt injection be prevented with a stronger system prompt?
A stronger prompt can help, but it is not sufficient. Reliable protection also requires external permission checks, data isolation, tool validation, monitoring, and limits on consequential actions.
Why is prompt injection dangerous for AI agents?
An agent may have access to tools, private data, or external services, so a successful injection can turn a misleading instruction into an unauthorized action rather than only a bad answer.
