Prompt Injection
Prompt injection is an attack in which crafted input causes a model to ignore its original instructions and follow the attacker's instead. Because models cannot reliably separate trusted instructions from untrusted data in the same context, malicious text — even hidden in a retrieved document — can hijack behavior.
Definition
Prompt InjectionPrompt injection exploits the fact that a language model processes system instructions and user or third-party content as one stream of tokens. An attacker embeds directives ("ignore previous instructions and...") in user input or in external content the model reads, potentially causing data exfiltration, unsafe actions, or bypassed guardrails.
Indirect prompt injection, where the malicious instruction lives in a webpage, email, or document the model retrieves, is especially dangerous for agents and RAG systems. Defenses include input isolation, least-privilege tool access, output filtering, and human confirmation for sensitive actions; no single measure is a complete fix.
Frequently asked questions
What is Prompt Injection?
Prompt injection is an attack in which crafted input causes a model to ignore its original instructions and follow the attacker's instead. Because models cannot reliably separate trusted instructions from untrusted data in the same context, malicious text — even hidden in a retrieved document — can hijack behavior.
Sources
Related terms
← Full AI & prompt engineering glossary
Put Prompt Injection to work with Prompeteer, the Agentic Contextual AI Platform →