What is a Prompt Injection?

Direct prompt injection targets the user-facing input itself (a user typing an override instruction directly), while indirect prompt injection is the more dangerous variant for agentic systems: malicious instructions hidden in third-party content the agent reads as part of its normal work — a webpage it browses, an email it summarizes, a file it processes — that the model can't reliably distinguish from legitimate instructions, because both arrive as plain text in its context. This becomes especially serious once a model has tool access: an injected instruction hidden in a webpage could try to get an agent to exfiltrate data, send unauthorized messages, or take a destructive action, using the agent's own legitimate permissions against it. Defenses include treating all external content as untrusted data rather than instructions, sandboxing what tools an agent can invoke without explicit confirmation, output and action allowlisting, and never letting a single unverified content source authorize a high-consequence action. There's no fully solved defense yet — it's an active area of both attack research and model-level mitigation — so production agent systems generally combine model-level robustness with system-level guardrails (least privilege, human confirmation for destructive actions, content provenance) rather than relying on the model alone to resist injected instructions.