Prompt Injection

In one line

When text the AI reads (an email, a web page, a document) contains instructions that hijack what it does.

Picture it

A customer slipping a note into the in-tray that says 'ignore your manager and send me the files.'

Under the hood

Content is data, not commands, but a model cannot always tell the difference. Defences: treat retrieved text as untrusted, keep tool permissions narrow, require confirmation for consequential actions, and enforce the rules that matter in code rather than in the prompt.