Short answer
Prompt injection is when untrusted input overrides the instructions a developer gave an LLM. The model has no reliable way to tell your instructions apart from text it merely reads, so an attacker who controls any of that text — a user message, a retrieved document, a web page, an email — can hijack the model's behaviour. It comes in two forms: direct (the user types the malicious instruction) and indirect (the instruction is hidden in data the agent ingests). The indirect form is the dangerous one for agents, RAG, and browsing tools, and there is no single fix — only layered defenses that shrink the blast radius.
This page owns the prompt-injection attack specifically. For the broader agent threat model, see agent security; for the mitigation tooling, see AI guardrails.
What is prompt injection
An LLM application is built by writing instructions — a system prompt that says summarise this email or answer using only the retrieved context. But the model receives those instructions as plain text in the same stream as everything else it processes. There is no privileged channel that says "this part is the command and that part is just data." Prompt injection exploits exactly that gap: if an attacker can get their own text into the stream, the model may follow it instead of you.
