Prompt injection explained in plain English, and how to protect yourself

Prompt injection means slipping sentences written like instructions into text that an AI will read, so that it follows them instead of yours. In a simple chat it is mostly harmless, but it becomes a real security risk as soon as an AI agent reads your email or browses the web on your behalf.

The problem in one picture

Picture an overly eager personal assistant who handles your mail. You tell them: “Read these letters and summarize them.” In one of them, a stranger has slipped a tiny note at the bottom of the page, addressed to the assistant, asking them to also send a copy of your address book to someone else. A sensible person would spot the trick. An assistant who obeys everything might just do it.

That is exactly how prompt injection works: an instruction hidden inside data, which the AI mistakes for a legitimate order.

Why an AI falls for it

A large language model (LLM), the engine behind ChatGPT, Claude or Gemini, receives everything as text, stitched together: the designer’s instructions (the system prompt), your request, then the content it has to process, such as a web page, a document or an email. Inside the model there is no watertight wall between “what I’m asked to do” and “what I’m reading”. A well-crafted sentence in a document can carry as much weight as a real instruction.

The term was coined by Simon Willison in a blog post dated September 12, 2022, the day after Riley Goodside published demonstrations on GPT-3. It echoes SQL injection, a well-known web flaw in which malicious data is treated as commands.

The comparison has limits, and that is precisely the problem. Against SQL injection, developers have proven techniques to keep data and commands strictly apart. With a language model, that separation doesn’t exist in the same way: everything is natural language. Nor can you simply ban a few suspicious phrases, because the same intent can be worded in countless ways, in any language. That’s why today’s defenses focus on limiting the damage of a successful injection rather than promising it will never happen.

Direct or indirect: two families

Type	Where the rigged text comes from	Who sees it	Typical situation
Direct	The person typing to the AI	That person	A user tries to get a customer service chatbot to ignore its rules
Indirect	External content the AI processes	Often nobody	A web page, PDF or email contains invisible instructions

Direct injection mostly concerns companies that deploy a chatbot: a visitor tries to make it say or do something it shouldn’t. Indirect injection is the one that affects you more: you often see nothing, because the text can be white on a white background, tucked into a file’s metadata or buried in a long page.

Why agents change everything

With a classic chatbot, a successful injection produces at worst a wrong or slanted answer. You read it and you can judge it. With an agent, the stakes are different. An agent uses tool calling: it can send an email, fill in a form, click a button or edit a file. A hidden instruction can then turn into a real action, with your access rights.

Here is a plausible scenario. You ask an agent to sort your inbox and reply to urgent messages. One email, from a stranger, contains an invisible passage written as an instruction to the assistant, asking it to forward certain messages to an outside address. If the agent is allowed to send email without approval, it may comply without you noticing anything.

Browsers with built-in agents are especially exposed, because they read pages written by anyone while having access to your logged-in sessions. According to the site’s profile, Perplexity describes a multi-layered defense for its Comet browser: classifiers, confirmation prompts and an external audit. These measures reduce the risk without eliminating it. Our guide to the risks of handing your accounts to an AI agent covers the precautions to take.

How providers and developers defend against it

OWASP recommends combining several measures, which can be summed up as follows:

1. Constrain the model’s behavior with precise instructions about its role and limits.
2. Define and validate the expected output format.
3. Filter what goes in and what comes out, using guardrails that flag suspicious content.
4. Apply least privilege: give the agent only the access its task requires.
5. Require human approval for high-risk actions, following the human-in-the-loop principle.
6. Separate and label external content, so the model knows what comes from an untrusted source.
7. Test the system regularly by simulating attacks.

None of these measures is enough on its own. Stacking them is what makes an attack harder and limits the damage.

What you can do in practice

• Grant the minimum access. An agent that summarizes your email doesn’t need permission to send any.
• Keep approval for sensitive actions: payments, sending, deleting, account changes.
• Don’t leave an agent alone on your bank, your work email or government services.
• Be wary of answers that go off track: a sudden change of topic, an unexpected link, a request for personal details.
• Tighten your assistants’ privacy settings to limit what could leak: follow our tutorial on ChatGPT, Claude and Gemini privacy settings.
• Assess a task before delegating it with our tool Can I trust an agent with this?.

For the big picture on what happens to your data, read our guide on AI and privacy. And since scammers adopt new techniques quickly, keep the most common AI scams in mind too.

Check yourself An agent has to summarize a web page for you. The page contains a hidden passage asking it to open your inbox. Which setting limits the damage most?

Give the agent permission to read the page only, with no access to your email, and require your confirmation before any action. Even if the agent “believes” the hidden instruction, it cannot carry it out.