What is prompt injection?
Prompt injection is an attack in which text inside content the model processes — a web page, a document, an email, a support ticket — is interpreted as instructions rather than data.
It is difficult to solve at the model layer because the model has no reliable way to distinguish its operator’s instructions from convincing text in its input. Both arrive as tokens.
The practical mitigation is architectural rather than linguistic: assume injected instructions will sometimes be followed, and make sure that following them cannot do much. An agent that can only call approved actions, scoped to one tenant, with writes gated by approval, is one where a successful injection is an annoyance rather than a breach.
Scope comes from the token, not the conversation, so no instruction in retrieved content can widen it. Writes remain gated on a human decision.
Related terms
- Guardrails — Constraints that bound what an AI system can do, distinct from instructions that ask it to behave.
- Human in the loop — A design where a person approves or rejects a consequential action before it executes.
- Multi-tenancy — One deployment serving many customers, with each customer’s data isolated from the others.
See it working rather than described.
The product demo runs one agent across three systems and stops at the approval gate.