Risks · Fast-moving · Intermediate

Prompt Injection

An attack where malicious instructions hidden in content the model reads cause it to ignore its real instructions.

What Prompt Injection is

Because models cannot reliably distinguish trusted instructions from untrusted data, a web page, email or document can carry text that hijacks an assistant's behaviour. Indirect injection through retrieved content is the dangerous variant for agents.

How it works

Mitigations reduce rather than remove the risk: treat all retrieved content as untrusted, restrict tool permissions to the minimum, require human approval for consequential actions, isolate sessions, and validate outputs. There is no known complete defence at the prompt level.

Why it matters

Any agent that reads external content and can also act is exposed. It is the defining security problem of agentic AI.

Common uses

→Threat modelling for AI features
→Agent permission design
→Security review checklists

Watch for

✓No complete mitigation exists today
✓Attack surface grows with every tool and data source

Continue exploring

AI Guardrails AI Agents Model Context Protocol AI Data Exfiltration AI Red Teaming