Prompt injection is an attack where malicious text, typed directly into a chat, hidden in a document, or embedded on a webpage an agent reads, tricks a language model into ignoring its original instructions and following the attacker's instead, often to leak data, bypass a safety rule, or trigger an unwanted tool call.
What is the difference between a direct and an indirect prompt injection?
A direct injection comes straight through the chat input, a user typing an instruction meant to override the system prompt. An indirect injection is the more dangerous variant for an agent: the malicious instruction sits inside a document, email, or webpage the agent reads as part of doing its job, so it never passes through anything a person typed at all.
Why is prompt injection especially dangerous for an AI agent, not just a chatbot?
A chatbot that gets tricked produces a bad reply a person reads and discards. An AI agent that gets tricked can act on the injected instruction directly, calling a tool or sending data somewhere it should not go, since the model cannot reliably tell its own developer’s instructions apart from text it is merely processing. Guardrails that screen input before it reaches the model, and a human approval gate on the actions that actually carry risk, are the two layers that catch what the model itself cannot.
Frequently asked questions
What is the difference between a direct and an indirect prompt injection?
A direct injection comes straight through the chat input, a user typing an instruction meant to override the system prompt. An indirect injection sits inside a document, email, or webpage the agent reads as part of its job, so it never passes through anything a person typed.
Can a language model just learn to ignore prompt injection?
Not reliably. The model cannot always tell its developer's instructions apart from text it is merely processing, which is why the practical defense is layered: guardrails that screen input before it reaches the model, and a human gate on the actions that actually carry risk.