Prompt injection is an attack in which instructions hidden in content processed by an AI system — a document, web page, email or tool result — are interpreted as commands, causing the system to act against the intent of its operator or user.
What is prompt injection?
Language models do not reliably distinguish instructions from data, so any retrieved content is a potential instruction channel. Indirect prompt injection is the enterprise-relevant form: an attacker plants text in a document or ticket the AI will later retrieve, and the injected instruction executes when an agent processes it. Input filtering helps but cannot be relied upon, because the attack surface is every source the system retrieves from. The durable mitigations are architectural — constrain what the system can reach and invoke, bind tool use to identity and purpose, and require approval for consequential actions, so a successful injection has limited reach.