Definition
Prompt injection is an attack or failure mode in which untrusted input tries to override instructions, disclose protected information, or influence actions beyond the input’s authority. The input may come directly from a user or indirectly from retrieved documents, web pages, emails, and tool results.
Simple example
A document indexed by a RAG system contains hidden text telling the assistant to ignore its rules and send other customers’ records to an external address. When that document is retrieved, the embedded instruction reaches the model as data. If the application executes the resulting model-generated tool request without checking authorization itself, the trust boundary has failed.
Why it matters
AI applications combine instructions and data in a form the model interprets together. An attacker can exploit that ambiguity to steer outputs or tool choices. In systems that retrieve external content or expose side-effecting tools, successful injection can have consequences beyond a misleading chat response.
One important nuance
Prompt wording alone cannot create a reliable security boundary. Separate trusted instructions from untrusted data and limit what reaches the model. The system must enforce authorization outside the model and validate tool calls at the execution boundary. Use explicit approval for sensitive effects when the risk warrants it. Structured outputs and content filters can reduce some risks, but they do not prove that a requested action is authorized or safe.