What is prompt injection? Examples and how to defend against it

The problem in one sentence

Language models can’t reliably tell the difference between your instructions and instructions hidden in the text they’re given, so anyone who can put text in front of your AI can try to take control of it.

Direct prompt injection

A user types instructions straight into your chatbot, such as asking it to ignore its rules, reveal its hidden instructions or pretend to be a different assistant.

• Asking the bot to reveal its system prompt
• Role-play tricks that sidestep content rules
• Requests to perform actions the user isn’t entitled to

Indirect prompt injection

The more dangerous kind. Instructions are hidden in a web page, PDF, email or support ticket that your AI later reads. The person affected may never see the malicious text.

• An AI email assistant reads a message telling it to forward the inbox
• A summariser visits a page with hidden white-on-white instructions
• A document in your knowledge base tells the bot to share a phishing link

Why filters alone don’t work

Blocklists of phrases such as “ignore previous instructions” are easy to get round with rewording, other languages or encoding. Treat filtering as one small layer, not the defence.

Defences that actually help

• Enforce permissions in your own code, never in the prompt
• Give the AI only the data and tools the current user is allowed to use
• Require confirmation before emails, payments, deletions or record changes
• Treat AI output as untrusted: escape it before displaying it and validate it before acting on it
• Keep secrets and internal rules out of the system prompt
• Log conversations and tool calls so you can spot abuse

Testing for it

Prompt injection testing means trying both direct and indirect attacks against your real setup — including the documents and tools your AI is connected to. It’s a core part of our complimentary AI pentest.