Prompt Injection

What is Prompt Injection

Prompt injection is an attack where instructions are hidden inside content an agent reads, rather than sent directly by the user, a comment buried in a web page, hidden text in a file, a crafted string in a tool's returned result, all trying to get the agent to follow the attacker's instructions instead of the actual task it was given.

The risk is highest wherever an agent processes untrusted content with real tool access: browsing a page and then having permission to send emails, reading a file and then having permission to run commands. If the agent treats everything it reads as potential instructions rather than as data to evaluate, hidden text in that content can redirect its actions.

This is not the same as a user directly trying to jailbreak the model with a clever prompt, the source is different: injection comes from data the agent was asked to process, not from the conversation itself. Defenses center on treating fetched content strictly as information to reason about, keeping the actions an agent is allowed to take scoped tightly, and using permission prompts or sandboxing for anything consequential that follows untrusted input.