Prompt injection
Text the model reads (a doc, a page, an email) that gives it new orders and it obeys, because instructions and data look identical to it.
See it
What it is
A model receives instructions and data down the same pipe: it is all just text in the context window. Prompt injection is anything in that text which the model treats as a new order. Direct injection is a user typing 'ignore your system prompt'. Indirect injection, the one that actually hurts, hides the payload in content your app fetches: a support ticket, a scraped page, a PDF, white-on-white text in a CV, a code comment in a repo the agent is reading. Distinct from a jailbreak, where a user attacks the model's own safety training rather than your application's rules.
There is no known reliable fix, which is the part people skip. You cannot patch it away with a firmer system prompt, because the attacker writes text too and gets the last word. Design around it instead. Simon Willison's 'lethal trifecta' is the check to run: an agent is dangerous when it combines access to private data, exposure to untrusted content, and any way to send data out. Break one leg of the triangle and the worst case shrinks from data theft to a rude answer.
Practical mitigations: treat model output as untrusted user input, allowlist tools per task and default to read-only, require human approval for anything that writes, sends, spends or deletes, and block silent exfiltration channels such as model-authored image URLs and markdown links pointing at attacker domains. Gotcha: a tool result is context too, so an MCP server's tool descriptions and responses are themselves an injection surface.
Ask AI for it
Audit this agent for prompt injection and harden it. Wrap every piece of retrieved or user-supplied content in explicit delimiters labelled as untrusted data that must never be followed as instructions. Replace the open tool list with a deny-by-default allowlist scoped per task, make every write, send, spend or delete tool require explicit human confirmation with the exact arguments shown, and strip or proxy any URL the model produces in links and image tags so nothing can be exfiltrated through a query string. Then add regression tests that feed known injection payloads through the document ingest path and assert no tool call fires.