Prompt injection is to language models what SQL injection was to early web applications: the flaw that shows up everywhere, that everyone underestimates at first, and that turns out to be a property of the design rather than a bug you can patch away. If you test AI systems for a living, or you are about to deploy one, it is the vulnerability to understand before any other.
The Root Cause
A language model has no real separation between its instructions and the data it is given to work on. Both arrive as text, in the same channel, and the model does its best to follow all of it. A web application keeps code and user input apart, at least in principle. A model cannot, because to a model there is no code, only more text. When the data contains something that reads like an instruction, the model may follow it.
That is the whole vulnerability. Everything else is a variation on it. Because the flaw is inherent to how the model reads text, it cannot be fully removed, only managed. Anyone selling a product that claims to eliminate prompt injection is selling confidence, not a fix.
Direct and Indirect
Direct injection is a user typing instructions to subvert the system: telling a chatbot to ignore its rules and reveal its configuration, or to adopt a persona that behaves differently. It is the version everyone thinks of, and the easier one to blunt.
Indirect injection is the dangerous one. Here the malicious instruction is not typed by the attacker at all. It is planted in content the model will later read: a web page it browses, an email it summarises, a document it ingests, a support ticket it processes. The victim is a legitimate user who asks the model to do something ordinary, and the model, reading the poisoned content along the way, quietly follows the attacker’s instruction instead. The user never sees it happen.
An assistant that reads your email and can send messages is a clear example. A single email, crafted to be read as an instruction, can tell that assistant to forward your inbox elsewhere. Nobody clicked anything. The attack arrived as data and was executed as a command.
Why It Gets Worse With Tools
A model that only produces text can, at worst, say something it should not. A model wired to tools, one that can send email, query a database, call an API or run code, can act on an injected instruction. The moment a model can do things, prompt injection stops being an embarrassment and becomes a route to real damage. This is why agents, which are models given tools and autonomy, are the highest-risk deployments of all.
What Actually Helps
Since the flaw cannot be removed, the defence is to limit what a successful injection can achieve.
- Least privilege for the model. Give it the narrowest set of tools and permissions the task needs. A model that cannot send email cannot be told to.
- A human in the loop for consequences. Any action that moves money, sends a message or changes data should require a person to confirm, not the model’s own say-so.
- Treat all retrieved content as hostile. Anything the model reads from outside, a page, a file, a ticket, is untrusted input, exactly as user input is in a web app.
- Separate and label context. Keeping system instructions, user input and retrieved data clearly delineated helps, though it is mitigation, not a cure.
Testing for It
When you assess an AI system, map every place it reads text it did not generate, then ask what the model can do if that text turns out to be an instruction. The interesting findings are almost never in the chat box. They are in the document it summarises, the page it fetches and the tool it is allowed to call.
The Short Version
Prompt injection exists because a model cannot tell its instructions apart from the data it reads. The direct form is a nuisance; the indirect form, where the instruction hides in content the model ingests, is the real threat, and it becomes dangerous the moment the model has tools to act. You cannot remove it, so you contain it: least privilege, human confirmation for anything that matters, and every piece of retrieved content treated as hostile.