Watch: Prompt Injection
An attack that smuggles instructions into the text a model reads so it obeys them; the indirect form hides them in retrieved web pages or documents an AI agent acts on.
Transcript
Prompt injection is an attack that smuggles malicious instructions into the text a language model reads, tricking the AI into following them instead of its original rules. Because a model treats all input as a single stream of text, it has no built-in way to separate trusted instructions from untrusted content.
The most dangerous variation is indirect prompt injection. Here, the hostile instruction is not typed by the user. Instead, it is hidden inside a web page, an email, or a document that the AI retrieves. When an agent browses the web to find an answer, it can ingest this planted text and act on it. This makes prompt injection a critical threat to any system with memory, tools, or browsing capabilities.
Currently, there is no complete fix. The openness that makes these models so useful also makes them vulnerable. Securing them requires layered defenses, like separating instructions from data, limiting which tools an agent can call, and filtering inputs and outputs. Ultimately, the security of these systems depends on the trustworthiness of the sources they read. For publishers and users alike, source credibility is no longer just about search rankings, it is now a fundamental security boundary.