Prompt injection: when a document becomes an attack

Text is not always harmless

An AI assistant opens a document to summarize it. Inside, a sentence tells the assistant to ignore the task and invoke a connected tool. That sentence does not come from the authorized user; it is external content trying to become an instruction.

This is the core of prompt injection. The document need not look suspicious to a human reader. Hostile instructions can appear on webpages, in search results, emails, or files retrieved by a RAG system.

More than an ordinary mistake

The risk emerges when software fails to separate trusted instructions from untrusted data. Language models interpret text; they are not authorization systems. If connected to powerful tools, confusion can result in unwanted actions.

Practical defenses include least-privilege permissions, human approval for consequential actions, output validation, and enforcement in application code. A retrieved document should never be able to grant an agent additional powers. Safeguards must still hold when the model misinterprets content.

Security is an architectural property

A single sentence in a system prompt cannot solve the problem. Developers need to examine data entry points, trust boundaries, and available tools.

AI is useful precisely because it can read unstructured information. The more outside material it reads, the more important it is to remember that reading an instruction is not permission to obey it.