Phase 09 · Production AI engineering Core

Prompt injection and AI security

Prompt injection is malicious instruction text hidden inside data the model reads.

In plain terms

A page can contain text that says 'ignore previous instructions'. If your assistant reads that page and has tools or secrets, the page can try to steer it.

Why it matters

LLMs see both commands and content as tokens, so you must design systems where bad instructions cannot do much harm.

How it works

Use least privilege, separate untrusted content, confirm high-impact actions, filter outputs, and red-team the workflow with hostile examples.

When you use it

Any time untrusted input meets private data, tools, or external communication.

Common mistakes

  • Believing the system prompt is a complete defense.
  • Letting retrieved documents issue instructions.
  • Testing only polite inputs.

Best practices

  • Design permissions so attacks fail to matter.
  • Require confirmation for send, delete, pay, or publish.
  • Keep an injection test suite.

Try it yourself

Plant a hostile instruction in a retrieved document and harden your bot until it refuses to follow it.

Resources