Prompt injection
Untrusted content that manipulates a model's instructions.
Security
Definition
Prompt injection occurs when text a model ingests — a web page, document or user message — contains instructions the model follows as if they came from the operator.
Indirect injection, where the payload arrives through retrieved content, is the harder variant to defend.
Why it matters
Any AI feature with tool access and untrusted input is exposed to data exfiltration and unauthorised actions.
How to apply it
- Treat all retrieved content as data, never instructions.
- Constrain tool permissions to the minimum for the task.
- Require confirmation for irreversible actions.