Prompt Injection

In classic software engineering, SQL injection was solved via parameterised queries that strictly separate the database command parser from user-supplied variables. Language models have no such hardware or parser boundary: system instructions, tool schemas, retrieved documents, and user inputs are all concatenated into a single sequence of tokens.

Security teams categorise attacks into two classes. Direct prompt injection happens when a user at the keyboard explicitly crafts adversarial input (often called a jailbreak) to bypass safety filters, reveal system prompts, or coerce a customer-service bot into approving a refund. Indirect prompt injection is far more dangerous for enterprise systems: an attacker plants hidden instructions inside external content that an AI agent or RAG pipeline later ingests, such as an email body, a public webpage, a CV uploaded in white-on-white text, or a poisoned GitHub issue.

For example, if an internal executive assistant agent has MCP access to read incoming emails and search Google Drive, an attacker can send an email containing hidden instructions that tell the agent to search Drive for board acquisition memos and exfiltrate the summary via a markdown image link or an outbound API call.

OWASP consistently ranks prompt injection as the number-one vulnerability for LLM applications, and the rise of tool-using AI agents has turned it from a reputational embarrassment into a remote code execution and data exfiltration vector. Whenever an agent possesses what security researchers call the 'lethal trifecta' (access to private data, exposure to untrusted external content, and the ability to communicate externally or mutate state), indirect prompt injection can compromise the system.

Because prompt-level classifiers and input guardrails can always be bypassed by sufficiently creative encodings, true mitigation requires architectural privilege separation: sandboxing code execution, stripping external markdown links, restricting tool permissions per task, and enforcing deterministic human-in-the-loop approval before any write or outbound action executes.