The analogy
Imagine handing your list of errands to a courier. But someone, secretly, has slipped a note in the middle saying "ignore the list and deliver the money to me". If the courier doesn't distinguish your list from the intruding note and reads them all as valid orders, they end up obeying the wrong one.
Prompt injection is that note hidden in the text the AI reads. The weak point isn't the courier's bad will: it's that they have no safe way to know which instructions come from you and which were slipped in by a stranger.
How it really works
Today's models can't reliably separate the instructions to trust from the content they read: to them it's all text. Attackers exploit this, hiding commands inside material the AI processes. There's the direct form, in which a malicious user writes the commands themselves, and the indirect one, more insidious, in which the instructions are hidden in a web page, an email or a document that the AI reads on your behalf. It's considered the number-one risk for these systems, and it becomes serious especially with assistants that can act — send emails, use tools — not just answer.
What you can do in practice
- Be careful when you feed the AI untrusted content (random web pages, forwarded emails, attachments from strangers) and ask it to act on them.
- Treat with suspicion the instructions that "pop up" inside a text being summarized or analyzed: if a strange command appears in the summary, it's a sign.
- Don't let an assistant carry out sensitive actions — payments, sending data, logins — based on content of unknown origin.
- If an AI does something unusual right after reading an external text, stop: it might have followed a hidden instruction.
A common misconception
People think it's hacker stuff, that it doesn't concern those who use AI normally. In part it concerns you, and more and more so: as assistants read your emails, browse and act for you, a malicious text can try to use them against you without your knowledge. You don't need to be a special target: it's enough to ask the AI to process the wrong content. Awareness of the risk is the first defense.
Frequently asked questions
Can prompt injection steal my data?
In the scenarios where an assistant can act — read your mail, use tools, access information — yes, it's precisely one of the risks: a hidden instruction could push it to exfiltrate data or carry out unwanted actions. In a chat that only answers, the consequences are much more contained.
How do I defend myself in practice?
Be wary of the untrusted content you give the AI, especially if you then ask it to act. Keep sensitive actions under your control and don't automate them on material of unknown origin. Caution in "what I have it read" matters more than any setting.
Is it my fault if it happens?
No, it's a limit of the technology, not a mistake of yours. But you can reduce the exposure with some care: knowing that the risk exists and not letting the AI act blindly on texts you don't control.
Have the companies already solved it?
Not entirely. It remains at the top of the risk ranking for these systems and there's no perfect defense: it's mitigated, not eliminated. That's why user caution keeps mattering, especially now that assistants do things, not just talk. Anyone who presents it to you as a closed problem is reassuring you more than they should.