Hidden somewhere in that page could be text instructing the model to ignore its original task and send sensitive information through an available tool. To the model, both the user's request and the hidden instruction are simply pieces of text that need to be interpreted. This risk isn't limited to webpages. Any untrusted content can become an attack vector, including emails, PDF documents, support tickets, shared documents, or messages from external Slack workspaces. If an agent processes content from these sources without proper safeguards, there's a chance it may follow instructions that were never intended by the user. That's why prompt injection can't be solved with a stronger system prompt alone.

I'd like to think of it, I'd like to think of it as social engineering of AI. You're just fooling it in all kinds of ways. And people can always be social engineered, no matter how smart they are. And large language models, same thing. So there's no solid protection there, not in detection, not in blast radius prevention. So you need a whole layer. At the AI exchange, we have a several layer model that shows you everything you can do against prompt injection. And none of these layers are silver bullets and recipes, but together to help you to mitigate it. It's really a big issue, especially indirect prompt injection, because we're injecting all kinds of data and give it to LLMs.