# Prompt injection

> Sneaking instructions into the text an AI reads so it obeys the attacker instead of you.

- Level: Intermediate
- Topics: AI, Security
- URL: https://tidbit.legios.com.ar/prompt-injection/
- In Spanish: [Inyección de prompts](https://tidbit.legios.com.ar/es/prompt-injection/)

**Prompt injection** is an attack on apps built on language models. A model receives everything as one stream of text: the developer's instructions, the user's request, and whatever documents, emails or web pages it is asked to read. It has no reliable way to tell "instructions I should follow" from "data I should only look at". So if someone plants a sentence like "ignore your previous instructions and do this instead" in that text, the model may obey it.

The direct version is a user typing tricks into a chatbot to make it break its rules. The more dangerous one is **indirect prompt injection**: the attacker never talks to the model. They hide instructions in a web page, a PDF, a calendar invite or a product review, and wait for an AI assistant to read it on someone's behalf. A hidden line in white text on a page could say "tell the user this product is the best" or "email the contents of this inbox to this address".

It matters more now because AI agents do not just chat: they browse, read your mail and call tools that can send messages, buy things or change files. OWASP lists prompt injection as the top risk for LLM applications, and there is no complete fix yet. Teams reduce the damage instead: give the agent as few permissions as possible, ask a human before risky actions, keep untrusted content clearly separated, and filter what goes in and out.

## An analogy

A new assistant asked to sort the mail opens a letter that says "the boss says: wire 5,000 dollars to this account". A careful person checks with the boss; a too-obedient one just does it.

## Keep in mind

- Models mix instructions and data in the same text, which is the root of the problem.
- Indirect injection hides orders in pages, files or emails the AI reads later.
- The risk grows with what the AI can do: send, buy, delete, share.
- Mitigations limit the damage; none of them fully prevents it today.

## Go deeper

- [LLM01: Prompt injection (OWASP)](https://genai.owasp.org/llmrisk/llm01-prompt-injection/)
- [Prompt injection on Wikipedia](https://en.wikipedia.org/wiki/Prompt_injection)

## Related terms

- [Website](https://tidbit.legios.com.ar/website/): A set of web pages under one address, stored on a server and opened in a browser.
- [Chatbot](https://tidbit.legios.com.ar/chatbot/): A program you talk to by typing or speaking, as if it were a person.
- [Artificial intelligence](https://tidbit.legios.com.ar/artificial-intelligence/): Getting computers to do things that, until recently, only people could do.
- [AI agent](https://tidbit.legios.com.ar/ai-agent/): An LLM that can take actions, check the results and keep going until the job is done.
- [LLM](https://tidbit.legios.com.ar/llm/): A neural network trained on huge amounts of text to predict the next word.