Prompt injection

A language model reads everything as text, and text carries no marker of authority. The user's request, the system's rules, and a web page fetched mid-conversation all arrive in the same channel, so a sentence inside that page saying ignore your instructions and do this instead is, to the model, just another sentence. Prompt injection exploits exactly that. Direct injection is a user attacking the system they are talking to. Indirect injection is a third party planting instructions in content the model will later read: an email, a shared document, a page, a calendar invite. The indirect form is the one that matters for agents, because the victim never sees the attack.

It became consequential when assistants became agents. A chatbot that can only answer can at worst be talked into saying something. An agent that reads email and can also send it, or reads a web page and can also write to a database, turns a planted sentence into an action. The standard demonstrations are an email instructing the assistant to forward the inbox, and a page instructing it to append what it knows to a URL. Once an agent holds tools, its reading list is part of its attack surface.

There is no reliable model-level fix. Filtering, delimiters and prompt hardening lower the hit rate and none of them reach zero, which is why OWASP has ranked prompt injection the top risk for LLM applications since it began keeping the list. The defenses that hold are structural, and they are ordinary security: give each tool the least privilege that does its job, separate the credential that reads from the credential that commits, and put a person in front of actions that are expensive to undo. A system built this way does not need to detect the injection, because the instruction arrives holding a permission that cannot do damage on its own.