Prompt injection and AI security
How hidden instructions in content can trick AI tools, and how to stay safe.
What is it?
Prompt injection is an attack where someone hides instructions inside content that an AI reads, such as a web page, email, document or image. The AI may follow those hidden instructions instead of yours, for example by revealing private information, giving a misleading summary or taking an unwanted action.
The risk grows when AI tools can browse the web, read your files or act for you through connected apps. Security experts list prompt injection among the top risks for applications built on language models, and there is no complete fix yet.
Which models use it?
- Any AI system that reads outside content can be affected, including chat assistants with browsing and file upload.
- AI agents and tools connected through plugins, connectors or the Model Context Protocol (MCP) have a larger attack surface.
- The OWASP Top 10 for LLM Applications lists prompt injection as a major risk.
- Providers such as OpenAI, Anthropic and Google publish guidance and add defences, but none claim full protection.
How to use it
- Be careful when asking an AI to read untrusted web pages, emails or files, especially with tools that can take actions.
- Give AI agents only the permissions they really need, and avoid connecting sensitive accounts unless necessary.
- Review and approve important actions, such as sending messages, buying things or deleting data.
- Be suspicious if an AI suddenly changes topic, asks for passwords or pushes you to click a link.
- If you build AI apps, treat all outside content as untrusted data, limit tool access and log actions.
- Never paste secrets such as passwords or API keys into prompts.
Benefits
- Understanding this risk helps you use AI agents and browsing features more safely.
- Human approval for important actions blocks most harmful outcomes.
- Limiting permissions reduces damage even if an attack succeeds.
Limits and risks
- There is currently no reliable way to fully prevent prompt injection.
- Hidden instructions can be invisible to people, such as white text or text inside images.
- More automation and more connected tools mean more ways to be attacked.
- Security advice changes quickly as new attack methods are discovered.
Prompt template
Copy it, replace the parts in [brackets] and paste it into any AI chat.
Act as a security reviewer for an AI feature. Feature description: [what the AI reads and what actions it can take]. List the ways prompt injection could reach it (for example web pages, emails, files, images). For each, describe the possible harm and a practical defence such as limiting permissions, human approval, input separation or logging. Finish with a short checklist I can follow before launch.
More in Safety and society
- Hallucinations and fact-checkingWhy AI sometimes states false things with confidence, and how to check its answers.
- Bias and fairnessHow AI can repeat unfair patterns from its data, and what you can do about it.
- Privacy and your dataWhat happens to what you type into AI tools, and how to protect personal information.
- Deepfakes, watermarking and content credentialsHow AI-made images, voices and videos are spotted and labelled.
- Copyright and AI contentWho owns AI-made work, and why the rules are still being decided.
- AI safety and responsible useSimple habits for using AI honestly, safely and with good judgement.