# What is Prompt Injection?

Also called Prompt Injection Attack.

Prompt injection is an attack in which text supplied by an untrusted party is interpreted by a language model as instructions rather than as data. Because a model sees one undifferentiated context window, attacker text can override developer intent and trigger disclosure of hidden instructions or unauthorized tool actions. It is widely considered an unsolved class of vulnerability.

The root cause is the absence of a hard boundary between control and data. A traditional program separates code from the strings it processes, and databases separate a query from its parameters. A language model receives system instructions, retrieved documents, and user messages as one sequence of tokens, so authority is inferred from wording rather than enforced by structure.

Consequences scale with what the model can reach. A model that only writes text can be pushed into revealing its system prompt or producing content that violates policy. A model wired to email, file storage, payments, or code execution can be pushed into taking real actions, which turns a content problem into a security incident with data loss or financial impact.

The defensive posture is containment rather than perfect detection. Treat every token that did not come from the operator as untrusted. Give the model the narrowest possible set of credentials and tools. Require explicit approval for consequential or irreversible actions. Validate outputs against a schema before they are executed. Log every tool call so an incident can be reconstructed afterward.

Partial mitigations include marking untrusted spans clearly in the prompt, running an independent classifier over inputs and outputs, and separating planning from execution so an untrusted document never influences the privileged step. All of these raise the cost of an attack without closing the class, and published defenses have repeatedly been bypassed by new phrasings.

## Key points

- Untrusted text is read as instructions, not as data
- Root cause is one context window with no control boundary
- Severity scales with the tools and credentials the model holds
- Defense is containment: least privilege, approvals, validation
- No general solution is known, only layered mitigation

## In practice

A support assistant summarizes customer tickets and can call a tool that closes an account. A ticket body contains text addressed to the assistant rather than to a human reader, framed as an updated policy from the operator. Without a boundary between ticket content and operator instruction, the model may follow it. An approval gate in front of the account-closing tool stops the action even if the model is fooled.

## Related terms

- [Indirect Prompt Injection](/en/glossary/indirect-prompt-injection)
- [Jailbreak](/en/glossary/jailbreak)
- [Input Safety](/en/glossary/input-safety)
- [Least Privilege](/en/glossary/least-privilege)
- [Approval Gateway](/en/glossary/approval-gateway)

[Back to the AI Glossary](/en/glossary)