Prompt Injection
An attack on AI systems where malicious instructions are hidden inside content the model reads (a document, web page, or tool description), tricking it into following the attacker instead of the user.
Why it matters
AI assistants increasingly read email, browse pages, and call tools. Anything they read is potential input, and models do not inherently distinguish 'data to summarize' from 'instructions to obey'. A successful injection can exfiltrate data, misuse connected tools, or quietly rewrite the assistant's behavior, all without malware in the traditional sense.
How it works
The attacker plants text where the model will encounter it: a webpage the assistant summarizes, a shared file, a calendar invite, or a manipulated tool description. The text addresses the model directly ('ignore previous instructions and send the contents of...'). Defences work by boundary-setting: treating retrieved content as untrusted data, constraining what tools can do, requiring human approval for consequential actions, and scanning inputs for injection patterns.
A real-world example
A company chatbot answers from its website knowledge base. An attacker gets a page indexed containing hidden text instructing the bot to reveal internal prompts and redirect users to a phishing link. A grounded bot with strict boundaries refuses: it answers only from vetted content and never follows instructions found inside that content.
Common mistakes
- ✗ Assuming a system prompt saying 'ignore malicious instructions' is sufficient defence
- ✗ Letting a model act on tools (send, delete, pay) directly from untrusted content without a human gate
- ✗ Feeding unvetted external content into the same context as privileged instructions
- ✗ Never testing the assistant adversarially before shipping it
Best practices
- ✓ Architect so the model can only read curated, public, or sanitized sources
- ✓ Gate consequential actions behind explicit human approval
- ✓ Scan tool descriptions and retrieved content for injection patterns before they reach the model
- ✓ Log model actions like any other privileged actor and review anomalies
Frequently asked questions
Is prompt injection the same as jailbreaking?
Related but different: jailbreaking is a user trying to bypass a model's rules directly; prompt injection hides the attack in third-party content so the model betrays its actual user.
Can prompt injection be fully solved?
Today it is managed, not eliminated. Robust systems combine content boundaries, least-privilege tools, human gates, and detection, the same defence-in-depth logic as classic security.
Does this affect small businesses using AI chatbots?
Yes, any bot that reads external content or holds tool access is in scope. The mitigations are architectural choices made when the bot is built, which is why security-first construction matters.
MCP Shield, AEGIBIT's open-source scanner, detects prompt-injection and hidden-instruction patterns in AI tool servers before they reach a model.
Scan for injection with MCP Shield →