Prompt injection
An attack where text processed by a language model is interpreted as instructions, overriding the developer's intent.
Updated
Prompt injection exploits the fact that an LLM receives instructions and data through the same channel. Direct injection comes from the user; indirect injection arrives inside content the model reads — a web page, document, ticket or email — meaning the attacker never needs access to your application. Indirect injection is now the dominant vector against agentic systems, since an agent is designed to retrieve and act on exactly this kind of content.
It cannot be filtered away reliably. The defensible design limits the consequence: tools authorised as the requesting user, confirmation for irreversible actions, retrieved content clearly labelled as data, and model output treated as untrusted everywhere downstream. Current best practice pairs this with architectural limits such as Meta's 'Rule of Two' — no agent may simultaneously process untrusted input, access sensitive systems and change external state.
Related
Prompt injection defence
Why prompt injection cannot be filtered away, why it has no full fix yet, and how to design AI systems — architecturally, not just with better prompts — so a successful injection has no useful consequence.
AI security
How to secure GenAI, LLM and agentic AI systems: current OWASP threat classes, layered controls, agent authority, retrieval isolation and monitoring.
AI security assessment
Security assessment of GenAI and LLM systems: prompt injection, tool and agent abuse, data leakage, model supply chain and monitoring gaps.
STRIDE for AI systems
Applying STRIDE to LLM and agentic applications: what each category means when untrusted text can act as instructions, where STRIDE stops covering multi-agent failure modes, and the controls per element.
LLM security controls
A control checklist for enterprise GenAI: data handling, retrieval isolation, agent authority, cascading-failure containment, monitoring, cost limits and vendor terms.
Three layers, three risk profiles
A security review that skips naming its layer — model, service, or agent — ends up testing the wrong attack surface.