Prompt Injection
Untrusted content that reaches a model's context and is treated as instruction.
Prompt injection is the attack in which text controlled by someone other than the operator reaches a model's Context Window and is acted on as instruction. In the indirect form the attacker never talks to the model at all — they plant text in a document, a web page, an issue description, or a dependency's release notes that the agent will later read.
It is structurally hard because models have no reliable boundary between instructions and data. Everything in the window is text. Filtering helps at the margins and cannot be relied on.
The defenses that hold are architectural rather than linguistic:
Least privilege. Scope what the agent can do so that a successful injection has a small ceiling. An agent that only needs to post a comment should not hold a credential that can write to the repository. See Least Privilege.
Close the exfiltration channels. Credentials tend to be sitting in the working directory — a version-control config that persisted an access token, an environment file — where an unrestricted read plus any outbound request walks them out. Restrict outbound destinations to a known list, and be aware that a search query is attacker-composed text sent to a third party, which is the one channel a destination allowlist cannot close.
Confirm before acting outward. See Human in the Loop.
See also10
Model Context Protocol
An open protocol for exposing tools, data, and prompts to AI applications through a uniform interface.
Agents & Language Models11 connections
Prompt
The text supplied to a language model to elicit a response.
Agents & Language Models14 connections
Guardrail
A rule constraining what a model may do, enforced by prompt, schema, or surrounding code.
Agents & Language Models17 connections
Secret Management
Storing, distributing, and rotating credentials without embedding them in code or history.
Systems & Tooling33 connections
Supply Chain Security
Protecting against compromise arriving through the code and tooling a project depends on.
Version Control & Delivery24 connections
Tool Use
Giving a model a set of callable functions so it can act on the world rather than only describe it.
Agents & Language Models27 connections
Large Language Model
A neural network trained to predict text, used as a general-purpose instruction-following system.
Agents & Language Models38 connections
Threat Modeling
A structured way of asking what could go wrong with a system's security before an attacker answers it, by drawing where data flows, marking where trust changes, and walking each crossing through a list of threats.
Testing & Verification8 connections
Server-Side Request Forgery
Tricking a server into making requests on an attacker's behalf, reaching internal services and cloud credential endpoints that the attacker could never reach directly, behind some of the largest cloud breaches.
Web Platform14 connections
Agent Sandbox
Confining an agent's commands to a limited environment, so that a mistaken or hijacked action can only damage what the sandbox allows it to reach.
Agents & Language Models14 connections
Linked from15
- Agent SandboxAgents & Language Models
Confining an agent's commands to a limited environment, so that a mistaken or hijacked action can only damage what the sandbox allows it to reach.
- Background AgentAgents & Language Models
An agent run that continues without a person watching, started by a schedule, an event, or a handoff, and reports its results when done.
- Code SigningSystems & Tooling
Cryptographically attesting who produced a binary, and the operating-system checks built on it.
- Confidence TrickMeaning & Society
Fraud that obtains trust first, so the victim hands over the money themselves.
- GuardrailAgents & Language Models
A rule constraining what a model may do, enforced by prompt, schema, or surrounding code.
- Human in the LoopAgents & Language Models
Requiring a person's judgment at chosen points in an otherwise automated process.
- Least PrivilegeSystems & Tooling
Granting only the permissions actually required, so a compromise has a small ceiling.
- Model Context ProtocolAgents & Language Models
An open protocol for exposing tools, data, and prompts to AI applications through a uniform interface.
- PromptAgents & Language Models
The text supplied to a language model to elicit a response.
- Secret ManagementSystems & Tooling
Storing, distributing, and rotating credentials without embedding them in code or history.
- Server-Side Request ForgeryWeb Platform
Tricking a server into making requests on an attacker's behalf, reaching internal services and cloud credential endpoints that the attacker could never reach directly, behind some of the largest cloud breaches.
- SQL InjectionData & Content
An attack in which user input is pasted into a database query and gets run as code, prevented by keeping the query and its data in separate channels.
- Supply Chain SecurityVersion Control & Delivery
Protecting against compromise arriving through the code and tooling a project depends on.
- System PromptAgents & Language Models
The standing instructions that frame every turn of a conversation with a model.
- Threat ModelingTesting & Verification
A structured way of asking what could go wrong with a system's security before an attacker answers it, by drawing where data flows, marking where trust changes, and walking each crossing through a list of threats.