Prompt injection is an attack technique that consists of introducing malicious instructions into the input of a language model to alter its behavior. Since these systems do not reliably distinguish between legitimate developer instructions and the content they process, an attacker can "sneak in" commands that the model ends up executing as if they were its own.
It matters because it compromises the security and confidentiality of AI-based applications. A distinction is usually made between two modalities:
- Direct injection: the user writes instructions that attempt to override the system rules (for example, "ignore your previous instructions").
- Indirect injection: malicious commands are hidden in external data that the model reads, such as a web page or an email.
A typical case is an assistant that summarizes documents and processes a text with a hidden command to leak private information. Mitigating it requires validating inputs, limiting model privileges, and clearly separating data from instructions, although no completely infallible solution exists.