An attack that smuggles instructions into the text a model reads so it obeys them; the indirect form hides them in retrieved web pages or documents an AI agent acts on.
Prompt Injection is an attack that smuggles instructions into the text a language model reads, getting the model to follow them instead of the instructions it was given. Because a model treats its prompt as one stream of text, it has no built-in way to tell a trusted instruction from attacker-supplied content that says "ignore your previous instructions and do this instead."
The dangerous form is indirect prompt injection, where the malicious instruction is not typed by the user but hidden in content the model retrieves: a web page, a document, an email, a product review. An AI agent that browses the web or reads a page to ground an answer can encounter planted text and act on it, which is why it matters for any system with tools, memory, or a browsing loop, such as an agentic harness or a Model Context Protocol connection.
There is no complete fix; it is the security counterpart to a model's openness to instruction. Defences layer up: separating instructions from data, constraining which tools an agent can call, and filtering inputs and outputs. For anyone publishing content read by AI systems it is also the mechanism behind hidden-text manipulation, which is why the trustworthiness of a source, and of the pages an agent visits, carries security weight and not only ranking weight.
