Prompt Injection
Text that tries to make the model ignore its instructions and follow the attacker's instead.
A prompt injection is a piece of text that, once it reaches the model's context, tries to override the instructions it was given. The attacker does not break the model; they talk to it, in the same channel as everything else the model reads.
This is structural, not a bug that gets patched. The model reads the system prompt, the user message, the tool results, and the retrieved documents, and it has no reliable way to mark one of those as instructions and the rest as data. If you paste an email into an assistant, the email's text is in the same position as the user's question.
The mitigations reduce the risk rather than removing it. Treat tool results and retrieved documents as untrusted, give the agent least privilege, keep destructive actions behind explicit human approval, and never let retrieved text grant itself permissions.
Related terms
Guardrails
Checks that stop or constrain an action before it happens.
Tool Result
What the harness sends back after running a tool: file contents, command output, an error.
RAG
Fetch the relevant documents first, then let the model answer using them.
Human in the Loop
A person who reviews, approves, or corrects the agent's work at key points.
Agent
A model with tools, a system prompt, and a loop that lets it act and observe results.
Want this working inside your team?
It starts with one conversation about your workflow.