Prompt injection

What it is

A language model has one input channel. Its operator's instructions, the user's request and any document it is given all arrive as text, and nothing in the model reliably separates instruction from data. Prompt injection exploits that. It is direct when the user types the hostile instruction, and indirect when the instruction sits in content the model reads on the user's behalf: a web page, an email, a file, a tool result. Indirect injection needs no access to the system at all. Bypassing safety restrictions is treated separately in jailbreaking and safeguard bypass; redirection of an agent's plan in agent goal hijack.

How it happens

• A user tells the model to ignore its instructions and it complies.
• A document submitted for summarising contains text addressed to the model.
• A retrieved web page carries instructions hidden from human readers.
• A tool returns content that the model treats as its next instruction.

Why it matters

A successful injection can extract data the model can see, trigger tool calls the user could not make, or produce harmful output that looks like a normal response. No complete technical fix is known, so the risk has to be managed by limiting what an injected instruction can achieve.

Warning signs

• Outputs that reveal or restate system instructions.
• Responses that address a party other than the user.
• Tool calls following the reading of external content.
• Inputs containing phrasing aimed at the model, such as role changes or overrides.

Who owns it

The system owner is accountable. Security engineering owns the defences and the testing. The business owner decides what the system may do without approval, which sets how much an injection is worth.

In practice

A mortgage adviser uses an assistant to summarise documents that applicants upload. One applicant's bank statement contains a line of small text telling the assistant to describe the applicant's income as verified. The summary says so. The same pattern generalises to any system that lets a model read content written by a party with an interest in the outcome.