What is prompt injection?
Prompt injection is an attack technique that feeds an AI model maliciously crafted input so that it ignores the instructions it was originally given and behaves as the attacker intends. You can think of it as social engineering, which tricks people, applied to AI.
As AI increasingly reads and processes external documents, web pages, and emails, it is treated as an important security threat.
What types of prompt injection are there?
They fall broadly into "direct injection," where a user enters malicious instructions straight into the chat window, and "indirect injection," where instructions hidden in a web page, document, or data the AI reads take effect.
Indirect injection in particular can happen through external content without the user realizing it, so it calls for extra care in agent environments that use tools. (This article does not cover specific attack wording.)
How is prompt injection different from jailbreaking?
A jailbreak tries to bypass a model's safety policies themselves to draw out forbidden answers, whereas prompt injection focuses on overwriting and hijacking the "original instructions" the model was following with external input.
The two overlap in places, but injection is a problem especially in architectures that trust and process external data.
How do you defend against prompt injection?
Perfect blocking is difficult, but the basic defenses are to handle untrusted external input separately from system instructions, minimize the permissions you give the AI to only what is needed, and require human confirmation before sensitive actions.
Layering several defenses is also recommended, such as verifying model output and tool execution results and monitoring for abnormal behavior.