Prompt injection and AI security
Prompt injection is malicious instruction text hidden inside data the model reads.
In plain terms
A page can contain text that says 'ignore previous instructions'. If your assistant reads that page and has tools or secrets, the page can try to steer it.
Why it matters
LLMs see both commands and content as tokens, so you must design systems where bad instructions cannot do much harm.
How it works
Use least privilege, separate untrusted content, confirm high-impact actions, filter outputs, and red-team the workflow with hostile examples.
When you use it
Any time untrusted input meets private data, tools, or external communication.
Common mistakes
- Believing the system prompt is a complete defense.
- Letting retrieved documents issue instructions.
- Testing only polite inputs.
Best practices
- Design permissions so attacks fail to matter.
- Require confirmation for send, delete, pay, or publish.
- Keep an injection test suite.
Try it yourself
Plant a hostile instruction in a retrieved document and harden your bot until it refuses to follow it.
Resources
- OWASP LLM Top 10 Security risks and mitigations for LLM applications.