Prompt Injection
Prompt injection is an attack that hides instructions in content an AI model reads, causing the model to follow the attacker's intent instead of the user's.
ON THIS PAGE
Definition
Why it matters
Use cases
Key features
FAQ
Definition
Prompt injection is an attack in which adversarial instructions are placed in content that an AI model will read, causing the model to act on the attacker's intent rather than the user's. Because large language models process instructions and data through the same channel — text — any text the model consumes is a potential instruction.
There are two broad forms.
Direct prompt injection
The attacker talks to the model themselves, crafting input that overrides its system prompt or safety constraints. This is the classic jailbreak.
Indirect prompt injection
The attacker never touches the model. They plant instructions in a resource the model will later ingest — a web page, a PDF, a code comment, a Jira ticket, a calendar invite, an email signature, an MCP tool description. When the agent reads that resource in the course of a legitimate task, it executes the attacker's instructions with the user's privileges.
Indirect injection is the more serious problem in enterprise settings, because it requires no access to the victim's session and scales to anything the agent might read.
Why it matters
Prompt injection is not an edge case; it is a consequence of how current models work. There is no reliable, general-purpose way to make a model distinguish trusted instructions from untrusted data when both arrive as text.
The severity is set by what the model can do. A chatbot that only answers questions has a disclosure problem. An agent with tools has an execution problem:
A coding agent that reads a poisoned README can be steered into exfiltrating environment variables or committing a backdoor.
A support agent with CRM access can be told to email customer records to an external address.
A browsing agent can be redirected mid-task to authenticate against an attacker-controlled service.
Crucially, every one of these actions is executed with the legitimate user's credentials, through approved tools, over approved network paths. To an EDR, a SIEM, or a DLP engine, the traffic looks like the user doing their job. Nothing in the request is malformed. What is anomalous is the intent — the gap between what the user asked for and what the agent went on to do.
See Agent steering: when the attacker uses your agent against you for a worked example.
Use cases
Real-world injection paths observed against agentic systems include:
Poisoned repository content. Instructions hidden in a README, code comment, issue, or dependency changelog that a coding agent reads while working.
Web page and search-result injection. Hidden text — white-on-white, zero-height, or inside HTML comments — that a browsing agent ingests as part of a page.
Document and ticket injection. Payloads inside PDFs, spreadsheets, support tickets, or meeting transcripts that a summarisation agent processes.
Tool-description injection. A malicious MCP server whose tool metadata contains instructions, so the model is compromised simply by connecting to it.
Cross-agent injection. One agent's output becomes another agent's input, propagating the payload through a multi-agent pipeline.
Memory poisoning. An injected instruction written into an agent's persistent memory, so it survives the session and re-fires later.
Related reading: Living off coding agents and what the Hugging Face incident teaches us about agent guardrails.
Key features and benefits
No single control stops prompt injection. Defence is layered, and it is weighted towards the action side rather than the text side.
Least privilege for agents. Scope every tool, token, and connector to the narrowest set of resources the task needs. Injection can only reach what the agent can reach.
Intent-aware runtime monitoring. Compare what the user asked for with what the agent actually did. Divergence between stated intent and executed action is the strongest available signal.
Action-level policy. Enforce guardrails at the point of effect — file write, network call, credential use, tool invocation — not only at the prompt.
Provenance and isolation of untrusted content. Mark externally sourced text as data, keep it out of privileged reasoning paths, and treat tool descriptions as untrusted input.
Human approval for irreversible steps. Require confirmation for destructive or outbound actions.
Full session recording. Prompts, tool calls, and outcomes captured end to end, so an injection can be reconstructed and scoped after the fact.
Frequently asked questions
Can prompt injection be fully prevented?
Not with current model architectures. Instructions and data share one channel, so filtering and system-prompt hardening reduce the rate but never reach zero. Practical defence assumes some injections will succeed and limits what a compromised agent is able to do.
How is prompt injection different from jailbreaking?
Jailbreaking is a user deliberately bypassing their own model's restrictions. Prompt injection is a third party subverting someone else's model through content it consumes. Jailbreaking is a policy problem; indirect injection is a genuine attack against a victim.
Why do traditional security tools miss prompt injection?
Because the resulting activity is authorised. The agent uses the user's real credentials and approved tools, so EDR, SIEM, and DLP see well-formed, permitted requests. Detection requires session and intent context — knowing what the user asked and how the agent's behaviour diverged from it.
Does input sanitisation solve it?
It helps at the margin and is worth doing, but it cannot be complete. Injection payloads can be encoded, translated, split across sources, or embedded in images and structured data. Sanitisation is a filter, not a boundary.
What is the highest-value control to add first?
Reduce agent privilege, then add runtime visibility into what agents actually do. Most severe incidents depend on an agent holding broader access than its task required.
Related terms
Related reading
Agent Steering: When the Attacker Uses Your Agent Against You
An attacker doesn't need to drop malware on your machine. They hand your AI agent a goal and let its own trust carry out the rest.
Living off Coding Agents - Claude as a C2 Server
Shadow AI Agents can hide command and control inside your trusted domain allowlist. A look at Claude Code Remote Control as a Living-off-the-Land C2 primitive.
Whatever Gets the Job Done: What the Hugging Face Incident Teaches Us About Agent Guardrails
OpenAI tested GPT-5.6 Sol and a more capable pre-release model on ExploitGym in an isolated environment. The models ended up leveraging zero-day vulnerabilities to compromise Hugging Face, all in service of their goal to solve the benchmark. The agents were determined, not to exploit, but to finish the task. How do security guardrails hold up in a world where agents perform a full-blown attack just to finish a simple job?
See what your agents are actually doing.
Dash discovers every AI agent, tool, and MCP server across your estate, understands session and intent, and enforces policy at runtime.