What is prompt injection in one sentence?

Instructions hidden in content the model reads, a web page, an email, a document, that the model then follows as if you had written them yourself.

Why can the model not just ignore instructions found in data?

Because there is no structural boundary between your instructions and the text it fetched. It is all one stream of tokens. Training makes models more suspicious, and a well-framed injection still gets through, so the real defence has to sit outside the model.

How do you actually defend against it?

By limiting what a successful injection can do: least-privilege tools, no silent access to secrets, human approval before irreversible or outbound actions, and treating everything fetched as untrusted. Filtering the text alone is a losing game.

Plain-language explainer

Prompt injection, explained

What is prompt injection, and why are AI apps insecure in new ways?

Prompt injection is when untrusted content the model reads contains instructions that hijack it. A model cannot reliably tell your instructions apart from text inside a web page, email, or document it was asked to process. So an attacker can hide 'ignore your task and do this instead' in that content. It becomes dangerous when an agent combines three things: access to private data, exposure to untrusted content, and a way to send data out. That combination, the lethal trifecta, is the recipe for data exfiltration.

Last reviewed July 25, 2026

Reading is the slow way. Start with a free lesson you can operate right now.

Start free: The harness: the loop, made real →

Free, no code, no signup.

Then go deeper: The lethal trifecta Locked

What people get wrong

Better training will fix it. Models still struggle to separate instructions from data; you design around it.
It only matters for chatbots. It is worst for agents that can read untrusted content and take actions.
Input filtering solves it. It helps, but the durable fix is limiting access, actions, and outbound paths.

Where you see it in real products

An agent that reads email and can send it is a classic injection target.
Browsing and document tools must treat fetched content as untrusted.
Safe designs scope credentials, gate risky actions behind approval, and log everything.

Common questions

What is prompt injection in one sentence?: Instructions hidden in content the model reads, a web page, an email, a document, that the model then follows as if you had written them yourself.
Why can the model not just ignore instructions found in data?: Because there is no structural boundary between your instructions and the text it fetched. It is all one stream of tokens. Training makes models more suspicious, and a well-framed injection still gets through, so the real defence has to sit outside the model.
How do you actually defend against it?: By limiting what a successful injection can do: least-privilege tools, no silent access to secrets, human approval before irreversible or outbound actions, and treating everything fetched as untrusted. Filtering the text alone is a losing game.

Related explainers

AI agents Computer-use agents LLM evals MCP

One idea at a time, in your inbox

New lessons and explainers, written the way these pages are. Now and then, not daily, and never a sales sequence.

We email you a confirmation link first. Unsubscribe in one click, any time. Privacy.

Part of See How AI Works, a free interactive course, where you learn how modern AI works by operating it, not watching videos.