Prompt injection — getting an AI system to follow instructions it was never meant to take, by hiding them in content it reads.
Why it matters once AI is connected to anything
A chatbot that can only talk is embarrassed by a prompt injection. An assistant that can read your inbox and send email is compromised by one. The indirect form is the one to plan for: the instruction arrives inside an email, a web page, a review or a PDF the system was asked to process, and the model has no fully reliable way to tell data from orders.
The OWASP Top 10 for Large Language Model Applications ranks prompt injection first in its 2025 edition. There is no complete fix at the model level yet; the defenses are architectural.
What limits the damage
- Give each AI system the narrowest permissions that do the job — read-only wherever possible.
- Keep a person in front of anything irreversible: sending, paying, deleting, publishing.
- Treat anything the model read from outside as untrusted, including its own summary of it.
- Log what the system did and why, so a bad day can be reconstructed.
Source: OWASP Gen AI Security Project, LLM01:2025 Prompt Injection.
Related: AI agent, human-in-the-loop, AI governance, Model Context Protocol.