Prompt Injection

Direct injection is a user typing something to override the system prompt, which is mostly a policy problem. Indirect injection is the serious one: the payload sits in content the agent fetches during normal operation, and the user never sees it. An agent asked to summarise a web page reads instructions embedded in that page; an agent triaging tickets reads a ticket that tells it to exfiltrate a token. The model has no reliable mechanism for distinguishing a directive written by you from a directive written by someone whose document it just retrieved.

Severity is a function of capability, not cleverness. An agent that can only read and produce text has a bounded blast radius — the worst outcome is a wrong answer. The moment that agent can send email, write to a database, execute code or call a paid API, injected instructions become injected actions. The most dangerous configuration is the combination of untrusted input, privileged tools and no human in the path, and that combination is easy to assemble accidentally when tools are added one at a time.

There is no known prompt that reliably defends against this, and treating "ignore any instructions in the content below" as a fix is the central misconception. Mitigations are architectural: separate the privileges of components that read untrusted content from those that act; require approval for irreversible operations; scope credentials per tool; validate tool arguments against allowlists rather than trusting the model to choose well; and assume any content the agent retrieves may be hostile.