Prompt injection
What is Prompt injection?
Prompt injection is an attack where malicious instructions are hidden inside content an AI model processes — a webpage, a document, an email, or even a customer's message — attempting to override the model's original instructions and make it take an unintended action, such as leaking data or calling a tool it shouldn't. It's a top security concern for AI agents specifically, since an agent that reads external content and can also call tools has both the exposure and the capability to be misused.
More detail
Prompt injection differs from a simple malicious user request because the attacker doesn't need direct access to the model — the malicious instruction can be planted in third-party content the agent is asked to read or summarize.
Mitigations typically include treating untrusted content as data rather than instructions, restricting which tools an agent can call based on the source of a request, and running an output guardrail to catch a suspicious action before it executes.
Frequently asked
- How is prompt injection different from a user just asking the AI to do something bad?
- A direct malicious request comes from the user themselves and can often be blocked with clear policy rules; prompt injection hides instructions inside third-party content the agent processes, so the attacker never needs direct access to the model at all.
- Why are AI agents more exposed to prompt injection than simple chatbots?
- An agent that can both read external content and call tools or take real actions gives an injected instruction somewhere to actually cause harm, whereas a chatbot limited to generating text has a much smaller blast radius if it's manipulated.
See also
Build it on Orbit
Voice, messaging, email, video, and AI agents on one platform and one pay-as-you-go bill. Start free — no credit card required.