Key takeaways
- External content can contain instructions intended to redirect an AI system.
- Treat retrieved pages, documents and tool output as data with limited authority.
- Constrain actual tool access even when the model appears to recognize an attack.
Overview
The input may arrive directly in a message or indirectly through a website, document, tool result or retrieved passage. The risk increases when the model can use privileged tools. Treat external content as evidence to inspect, not authority to change permissions. Separating instructions from data helps, but practical protection also requires constrained tools, validation and review of consequential actions.
How it works
Identify untrusted inputs and the privileged actions they could influence.
Limit tool permissions and validate requested actions against the original task.
Test adversarial content and log blocked or escalated actions.
Where the trust boundary is crossed
A company-research agent may read a public page containing a sentence that tells it to ignore its task and export workspace records. That sentence is part of the page being researched. It does not come from the user who authorized the task, and it should not gain the ability to change the agent’s objective or permissions. The difficulty is that both legitimate evidence and malicious instructions can arrive as ordinary text.
Injection can also be indirect: a document, search snippet, repository file or tool result can carry the attempt. Restricting the input box alone does not address those paths. Map every place untrusted text reaches the model and identify which later operations could expose data or change external state if that text were misinterpreted.
Source material: OWASP GenAI Security Project — Prompt injection ↓
Use controls at the action boundary
Separate reading a source from authorizing an action. A research tool can return facts without granting access to a messaging tool or an arbitrary destination. Limit credentials to the workspace and purpose, validate tool arguments outside the model and require the application to enforce export or write rules. A warning in a prompt should complement these controls rather than carry the entire security boundary.
The following examples illustrate defensive boundaries, not a guarantee that any single filter solves prompt injection. The useful test is whether a malicious instruction can cause an unauthorized effect.
| Untrusted material | Attempted redirection | Application boundary |
|---|---|---|
| Company webpage | Send workspace data elsewhere | No arbitrary export destination or credential access |
| Uploaded document | Override the requested objective | Task and action scope remain user-defined |
| Tool response | Claim an operation has been approved | Approval comes from authenticated application state |
Test effects as well as model responses
A model may correctly describe a malicious instruction while another component still passes its suggested URL to a tool. Test the end-to-end workflow with harmless controlled payloads and inspect actual tool calls, destination changes and logs. Include content that looks like a system message or a routine operational note, because formatting should not determine authority.
Record which boundary stopped the attempt and whether legitimate research still completed. Overly broad filtering can make the product unusable without addressing credential scope or tool authorization. Revisit the tests whenever new tools, sources or export capabilities are added, since those changes alter what an attacker could cause even if the underlying model remains the same.
What this looks like in practice
A research page contains text telling an agent to export its contact database. The research task authorizes reading that page, not obeying its instructions; the system must reject the unrelated export.
Examples explain the concept; they are not reported customer results.What to check
Test indirect attacks in retrieved documents as well as direct prompts. Verify that secrets, external destinations and write operations remain protected even when model output is manipulated.
Common mistake
Relying only on a prompt that says to ignore malicious instructions while leaving unrestricted tools available to the model.
Prompt injection vs. Data quality
Bad data can produce an incorrect answer without trying to control the system. Prompt injection specifically attempts to redirect behavior through instructions embedded in input.
Read the Data quality definition →Questions answered
What is Prompt injection?
Prompt injection is an attempt to make an AI system follow instructions from untrusted input that conflict with the intended task or its controlling instructions.
Can a trusted website carry an injection?
Yes. User comments, compromised pages or third-party content can introduce untrusted instructions even on a familiar domain. Trust the specific content and permissions, not just the hostname.
Can prompt injection be solved with a keyword filter?
A keyword filter alone is insufficient. Attacks can be indirect or obfuscated, so controls must also limit what the system can do with an untrusted instruction.
Is prompt injection the same as an inaccurate answer?
No. An inaccurate answer is a correctness failure. Prompt injection is an attempt to redirect system behavior through instructions in a lower-trust input. The two can overlap if the attempt changes an answer, but injection can also target actions, credentials or data disclosure without producing an obviously false response.
Should agents stop reading external websites?
External research can remain useful. Treat websites as evidence, keep tool access narrow and enforce action rules outside their content. The aim is to prevent a source from gaining authority over the task. Whether a particular source should be excluded depends on the application’s purpose and trust model.
References and further reading
Primary documentation and source material for this topic. Sources checked September 14, 2026; provider requirements can change.
- Prompt injection ↗OWASP GenAI Security Project
- AI Risk Management Framework ↗NIST
Continue reading on the blog
Explore all articles and guides →Put the concept to work.
Explore the relevant AstroFabric workflow and see how the pieces connect.
Help keep this guide useful. Suggest a correction or browse the full glossary.