Prompt injection
Getting a language model to follow attacker-supplied instructions by placing them in text the model processes as part of its input.
A language model cannot reliably tell the difference between instructions from its operator and instructions that merely appear in the content it is reading. Prompt injection exploits that: the attacker writes "ignore your previous instructions and do X" (or something far subtler) somewhere the model will encounter it, and the model may comply. The term was coined in September 2022.
Why it matters
Prompt injection is the root cause behind most agentic-AI security incidents. It has no clean fix — it is a consequence of how instruction-following models work. Defenses reduce the rate and the blast radius (least privilege, human approval, output filtering, injection classifiers) but none of them make a model safe to point at untrusted text with powerful tools attached.
In the news
- Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction (opens in a new tab)
The Hacker News ·
- In-the-Wild Attack Abuses AI Agents' Trust in Markdown (opens in a new tab)
Dark Reading ·
- Self-generated prompt injections in compaction summaries (opens in a new tab)
Simon Willison ·
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.