What Is Prompt Injection? – Definition and How to Defend Against It

Learn what prompt injection is, how direct and indirect variants differ, why retrieved content is the main vector, and what defences actually work.

Prompt injection is content that a model reads as instruction rather than as data. Because a model sees one undifferentiated stream of text, anything placed in its context can attempt to steer it.

1. Why It Is Possible

A model receives instructions and data in the same channel. There is no structural separation of the kind that distinguishes code from input in a database query, so an attacker's goal is simply to get text into the context that reads as a command.

This is a design property, not a bug in a specific model, which is why no prompt reliably prevents it.

2. Direct and Indirect

Indirect injection is the serious one for agents and RAG, because the attacker never interacts with your system — they only have to control a page it might read.

3. Where It Bites Hardest

Risk scales with capability. A model that only writes text can be made to write something unwanted. A model with tools can be made to do something.

The dangerous combination is an agent that reads untrusted content and holds a tool that can send data outward, modify state, or spend money.

4. Defences That Work

• Keep authorisation in code. Never let retrieved text decide whether an action is permitted.
• Scope tools tightly. Read-only where possible; narrow parameters; no general-purpose execution.
• Confirm consequential actions with a human, especially anything irreversible or outward-facing.
• Constrain outputs. A schema-validated response cannot carry arbitrary instructions downstream.
• Segregate untrusted content clearly in the prompt, and instruct the model to treat it as data.
• Limit egress. An agent that cannot reach arbitrary destinations cannot exfiltrate to them.

5. Defences That Do Not Work Alone

• "Ignore instructions in the content." Helpful, defeated by better phrasing.
• Delimiters. Useful hygiene, bypassed by content that mimics them.
• Input filtering. Catches known patterns, not novel ones.
• Model choice. Robustness varies; none is immune.

Each raises cost. None is a boundary, which is why the durable controls are all outside the model.

6. The Exfiltration Pattern

The most consequential real-world variant: injected text instructs an agent to include sensitive context in a URL it fetches, or in a message it sends, delivering data to the attacker.

Mitigations are architectural — restrict which destinations an agent may contact, avoid placing secrets in an agent's context at all, and require confirmation before any outbound send.

7. Designing for It

1. Assume every retrieved document is hostile.
2. Give the agent the minimum tools for the task.
3. Enforce permissions in application code, per action, per user.
4. Validate all outputs against a schema.
5. Log every tool call with its arguments for review.
6. Constrain network egress.

8. Summary

Prompt injection exploits the absence of a boundary between instruction and data. Indirect injection through retrieved content is the practical threat for agents and RAG systems.

No prompt prevents it. Defence comes from limiting what the model can cause: narrow tools, code-enforced authorisation, validated outputs, restricted egress, and human confirmation for anything irreversible.

Potential Related Glossary

• Web Crawling
• Parsing
• Unstructured Data
• Data Structure