What is prompt injection?
Prompt injection is an attack in which text that an AI system reads is written to make it ignore its instructions and do something else. Direct injection comes from the user typing it. Indirect injection is the more serious kind for companies: the instruction hides in content the AI processes on someone's behalf, such as a web page, an e-mail, a shared document or a support ticket, and the model follows it as if it came from its operator. If the AI can only answer in a chat window, the damage is limited to a wrong or embarrassing answer. If it can read a mailbox, call tools, query a database or browse, an injected instruction can make it leak data or take actions. There is no complete fix today, because models do not reliably separate instructions from data. What helps: give AI tools the fewest permissions possible, require human approval for actions with consequences, keep sensitive systems out of reach of agents that read untrusted content, and log what the AI did. OWASP lists prompt injection first among risks for LLM applications.