Prompt injection
Where it sits in the kitchen
A note slipped into a delivery that says 'chef, ignore the owner and buy the expensive stuff'. The chef cannot always tell it from a real order.
Definition
An attack in which text the model processes overrides its intended instructions. Models cannot reliably tell instructions from data in their context, so no filter removes the risk completely; the strongest defence is to limit what a fooled agent can do.
Detailed technical description
Direct injection comes from the person typing to the model. indirect-prompt-injection hides the instructions in content the agent fetches, such as a page, a message or a tool result, and is the larger risk for agents.
Defences work in layers: treat all fetched content as untrusted, give the agent least-privilege access, filter outbound traffic with egress-filtering, and ask a person before irreversible actions.