Definition & overview
Prompt injection is an attempt to make an AI system follow malicious instructions embedded in input or external content. Retrieved documents, websites and tool responses can carry attacks even when the original user request is legitimate.
Analogy & mental model
A document tells the assistant to ignore its manager and reveal the filing cabinet’s contents.
Treat external text as data, restrict tools and keep secrets outside prompts.
Why Prompt injection matters
Agents often read content from outside the organisation. An attacker can place instructions in that material and try to make the system treat them as authority. The risk grows when retrieved text is combined with powerful tools or private information.
Practical business example
A retrieved page tells a research assistant to send internal files to an external address. The safe workflow treats that sentence as page content and provides no export authority.
Illustrative scenario, not a client case study or promised result.
How Prompt injection works
- An attacker places instructions in a user message, document, webpage or tool response.
- The system incorporates that content into a model interaction.
- An unsafe system follows the embedded instructions instead of treating them as untrusted data.
Core components & mechanisms
- Untrusted content
- Instruction confusion
- Potential tool or data misuse
Filtering suspicious phrases alone is insufficient; limit tool authority and protect secrets outside the model.
Prompt injection vs Ordinary task instruction
A legitimate instruction comes through the authorised task channel. Prompt injection tries to cross a trust boundary through content the system is only meant to read.
Frequently asked questions
What does Prompt injection mean?
Prompt injection is an attempt to make an AI system follow malicious instructions embedded in input or external content. Retrieved documents, websites and tool responses can carry attacks even when the original user request is legitimate.
How is it different from Ordinary task instruction?
A legitimate instruction comes through the authorised task channel. Prompt injection tries to cross a trust boundary through content the system is only meant to read.
What is a sensible first step for a small business?
Treat external text as data, restrict tools and keep secrets outside prompts. An attacker places instructions in a user message, document, webpage or tool response.
What limitations should I keep in mind?
Filtering suspicious phrases alone is insufficient; limit tool authority and protect secrets outside the model.
Sources & further reading
OWASP: LLM application risksOriginal Mushbloom explanation and illustrative examples. References support the underlying topic, not every business recommendation. Check current documentation before implementation.
Turn the concept into a practical decision
Discuss your website or business workflow before choosing tools or implementation. Start with the problem, approved information and appropriate human oversight.
Book a free 20-minute audit →Explore the relevant serviceNo rankings, AI citations or commercial outcomes are guaranteed.