Prompt injection is an attack that tries to make an AI follow instructions it should treat as untrusted. When the model is part of an agent with tools, a hijack can turn misleading text into an unintended action or disclosure. The practical defense is not a magic phrase or a perfect filter: it is to separate trusted instructions from outside content and limit what the agent can do if it gets misled.
What is prompt injection?
Prompt injection occurs when instructions in a model’s context alter its behavior or output in an unintended way. The instructions may come from the person using the AI, or they may be embedded in material the AI is asked to read. The model processes both as text, but they do not have equal authority: a webpage or file should not be able to override the task and rules set by the system or the user.
As an Amazon Associate I earn from qualifying purchases.
OWASP’s LLM01: 2025 Prompt Injection describes direct and indirect forms of the vulnerability. It also cautions that retrieval-augmented generation (RAG) and fine-tuning do not fully mitigate it. Adding a knowledge base or training a model differently does not, by itself, make instructions inside retrieved content trustworthy.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteDirect prompt injection
In a direct attack, a user enters instructions intended to change how the model behaves—for example, asking it to disregard its assigned task and reveal information it should not provide. OpenAI’s user guidance compares prompt injection to social engineering: rather than exploiting a software bug in the traditional sense, the attacker tries to manipulate the model through instructions in its context.
#1 Best Overall
Indirect prompt injection
In an indirect attack, the instructions arrive through content the model reads, such as a website, document, email, retrieved passage, or tool result. The content might openly address the AI, or disguise instructions as ordinary material. A person may see harmless-looking text while the model treats it as guidance relevant to the task.
How can prompt injection hijack an AI agent?
An ordinary chat response can be misleading or unsafe. An agent raises the stakes because it may be able to act: read files, call services, change records, or transmit information. The model’s interpretation is the bridge between attacker-controlled text and those capabilities. The consequences depend on what the agent reads, how it responds, which tools and permissions it has, and what safeguards surround its actions; an injection attempt does not automatically succeed.
- The user asks the agent to complete a task, such as summarizing a page or processing a document.
- The agent reads content controlled or influenced by someone else.
- That content contains instructions aimed at the model, which compete with the user’s request or the agent’s governing rules.
- The model follows or gives weight to those instructions.
- If the agent has relevant permissions, it may take an action the user did not intend or expose information through a tool.
For example, an agent asked to summarize an email could encounter text in the message that tells it to forward private information. Whether that becomes a real disclosure depends on the agent’s behavior and whether it has permission to send mail without review. The same pattern applies to a webpage that tries to redirect a browsing agent or a document that attempts to alter a workflow.
Recommended Free Tools
Each additional tool or workflow step can create another place where untrusted instructions enter or influence a decision. Anthropic’s submission to NIST notes that tool use expands the attack surface and that multi-step workflows may create multiple injection points. OWASP’s 2025 guidance on agentic applications also places goal hijacking and tool misuse among the risks to consider.
How should you reduce prompt-injection risk?
Design for the possibility that the model will misread or follow hostile content. A filter may help detect some suspicious input, but it cannot reliably establish that everything the agent encounters is safe. OpenAI’s March 11, 2026 discussion of agent security makes the distinction directly: resisting manipulative content in context requires more than filtering inputs. Controls should reduce the chance of misinterpretation and, especially, limit the damage a mistaken interpretation can cause.
Separate instructions from untrusted content
Treat webpages, files, retrieved passages, emails, and tool outputs as data to analyze—not as privileged instructions. Keep them out of system or other privileged instruction channels. Make the source and trust level of content clear in the workflow, and do not let arbitrary retrieved text silently rewrite the agent’s task.
Limit tools, credentials, and permissions
Give an agent only the access needed for its specific task. A read-only tool has a different impact from one that can write, send, purchase, or delete. Scope credentials and data access accordingly, and avoid broad authority that lets a single mistaken decision affect unrelated systems or information.
Constrain what passes between steps
When one model call or tool hands information to another, use structured outputs with defined schemas and validate them before use. This makes it harder for arbitrary prose from an external source to become a command or parameter downstream. Validation should check the values and operations the next step is allowed to receive; a structured format alone does not make the underlying content trustworthy.
Require review for consequential actions
Put an approval gate before actions such as sending a message, changing a record, or making a purchase. Show the reviewer what will happen and what information will be shared or changed, so approval is informed rather than a generic click-through. OpenAI’s user guidance also recommends reviewing actions and controlling the permissions an agent receives.
Contain and monitor agent activity
Sandbox execution where appropriate, monitor tool activity, and keep records that help explain what the agent read and did. These measures are layers of protection, not proof that an attack was prevented. OpenAI describes sandboxing and monitoring alongside training, red-teaming, and user controls as parts of a broader approach.
Test the complete workflow
Test realistic adversarial content at every point where the agent reads external data or receives tool output, then check whether it can cause an unauthorized action or disclosure. Evaluate the full path—including retrieval, intermediate steps, tools, and approvals—not just the initial prompt or a standalone input classifier. RAG, fine-tuning, and prompt-level rules do not by themselves demonstrate that an agent is safe.
Free tools Windows power users keep installed
One-click scans. No signup required.
How to assess an agent’s exposure
When reviewing an agent design, follow the path from outside content to possible action. These questions help identify where to add controls:
| Review area | Questions to ask | What to examine |
|---|---|---|
| Input exposure | What outside content can the agent read, and who can control it? | Web pages, files, email, retrieved passages, and tool results. |
| Authority | What tools, credentials, and data can the agent access? | Whether each capability is read-only or can write, transmit, or otherwise change something. |
| Data separation | Can the agent distinguish trusted instructions from content it is meant to analyze? | Instruction channels, intermediate representations, schemas, and validation. |
| Action controls | Which actions require a person’s approval? | Whether the reviewer can see the actual change or information to be sent before approving. |
| Containment and review | Can activity be limited, observed, and tested? | Sandboxing, monitoring, logs, and adversarial tests across the full workflow. |
The key question is not only whether an agent can recognize a malicious instruction. It is also what that instruction could cause the agent to do, and whether the system can stop or contain the result.
What prompt-injection defenses can and cannot do
No single system prompt, detection product, training method, or input filter guarantees prevention. A prompt may tell an agent to ignore instructions in documents, and a classifier may catch some attacks, but neither removes the underlying conflict when untrusted content enters the model’s context. A safer design assumes that some malicious or misleading content may get through: it keeps the content unprivileged, limits the agent’s authority, validates handoffs, and requires review where the consequences warrant it.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
