What is prompt injection? Commands in source material are not user authorization
Explain instructions embedded in external content, separate user tasks from source data and validate tool boundaries with harmless samples.
Understand the concept
Prompt injection embeds instructions in inputs or external content to redirect the model beyond the task or boundaries. Pages, files and tool outputs can contain it. An email requesting attachment forwarding is still source content when the task is summarization, not authorization. Separate trusted instructions from data and constrain actions in the application.
Read content can imitate higher-priority instructions
Anthropic discusses untrusted content and tools and OpenAI recommends layered safeguards. Text claiming system authority gains no real permission but can influence models. One warning prompt is not complete protection. Define tools and checks in code and separate reading from writing. Evaluate redirection behavior rather than only keywords, which legitimate documents may quote.
Validate task and action boundaries with harmless material
In a test copy, embed a harmless request for an unrelated marker while asking for a summary. Check whether it is quoted as data or obeyed. Use simulated write targets and no real recipients. Record the task, embedded text and actions, distinguishing model deviation from permission failures. No attack or injection test occurred here. Passing examples does not establish immunity to unknown attacks.
Recheck boundaries as tools and content change
New tools change impact. Replay examples after model or format updates and inspect backend actions as well as replies. Preserve evidence and recovery and maintain normal utility rather than deleting all material or rejecting quoted commands. Validate actions against authorization, not the model’s verbal promise of immunity.
Checked sources
These sources support the concepts and methods described here. Examples and test scope are labeled separately; check the version of the tools you use.