Prompt injection
Prompt injection is an attack where text an AI agent reads as part of its task -- a web page, a document, a tool's response -- contains instructions crafted to manipulate the agent into doing something the user never asked for, because the model doesn't reliably distinguish trusted user instructions from untrusted content the task involves. A direct injection targets the model's own prompt interface; an indirect injection hides the instructions inside content the agent is only supposed to read, the more dangerous variant once agents have tool access, since a page the agent merely visits can trigger an unwanted email or API call. It needs no software bug, since it targets instruction-following behavior directly, which is why defenses focus on treating read content as data rather than commands, scoping which tools an agent can call without confirmation, and validating tool outputs instead of filtering every malicious phrase.
By AdminKit team, Netbase JSC · Updated