Prompt Injection

Prompt injection is the AI-era equivalent of a con artist slipping a forged note into an assistant's inbox. Because large language models follow instructions written in natural language, an attacker can bury commands inside content the model will later read — a web page, a product review, an email, a PDF, or text hidden in an image — and the model may obey them as if they came from the user.

In 'indirect' prompt injection, the victim never sees the malicious instruction: they ask their AI assistant to summarise a page or process an email, and the hidden text tells the assistant to exfiltrate the conversation, visit a malicious link, change a setting, or approve a payment. As AI 'agents' and agentic browsers gain the ability to act — to shop, send messages, or move money on a user's behalf — the stakes rise, because a successful injection can turn the user's own trusted assistant into the attacker's tool.

The practical defence is to keep a human in the loop for anything involving money, credentials, or irreversible actions, and to treat an AI that suddenly proposes such a step after reading external content with suspicion.