Prompt Injection

What is prompt injection?

Agents run on prompts, but their input is often full of outside data — web pages, emails, uploaded files. Prompt injection is when an attacker hides a malicious instruction inside that outside content, tricking the model into treating it as a new command and bypassing its original rules.

Why is it so dangerous?

Models can't tell "data" from "instructions"
To a model, a paragraph of webpage text and a system command are both just text. It's hard for it to know which to execute and which to treat as mere reference.
It uses the agent's own hands
Once an injection lands, an attacker might get the agent to leak private data, send emails, or run risky actions — all dressed up as a normal user request.

Common attack methods

Direct injection
Writing "ignore the previous instructions, instead do…" straight into the input.
Indirect injection
Hiding the malicious instruction inside a webpage or document the agent will read, so it walks into the trap on its own.
Jailbreaking prompts
Using role-play or story framing to nudge the model past its safety limits.

How to defend

Strictly separate untrusted external data from system instructions, give instructions higher priority, limit what the agent can do, and validate outputs — layered together, that keeps the risk down.

Bottom line: prompt injection is hiding a "bad command" inside the input to trick an agent into running it as a "good command".