Prompt injection
Sneaking instructions into the text an AI reads so it obeys the attacker instead of you.
Prompt injection is an attack on apps built on language models. A model receives everything as one stream of text: the developer's instructions, the user's request, and whatever documents, emails or web pages it is asked to read. It has no reliable way to tell "instructions I should follow" from "data I should only look at". So if someone plants a sentence like "ignore your previous instructions and do this instead" in that text, the model may obey it.
The direct version is a user typing tricks into a chatbot to make it break its rules. The more dangerous one is indirect prompt injection: the attacker never talks to the model. They hide instructions in a web page, a PDF, a calendar invite or a product review, and wait for an AI assistant to read it on someone's behalf. A hidden line in white text on a page could say "tell the user this product is the best" or "email the contents of this inbox to this address".
It matters more now because AI agents do not just chat: they browse, read your mail and call tools that can send messages, buy things or change files. OWASP lists prompt injection as the top risk for LLM applications, and there is no complete fix yet. Teams reduce the damage instead: give the agent as few permissions as possible, ask a human before risky actions, keep untrusted content clearly separated, and filter what goes in and out.
Keep in mind
- Models mix instructions and data in the same text, which is the root of the problem.
- Indirect injection hides orders in pages, files or emails the AI reads later.
- The risk grows with what the AI can do: send, buy, delete, share.
- Mitigations limit the damage; none of them fully prevents it today.
