Prompt injection: definition, risk and defence
Definition
Prompt injection is an attack in which manipulated text overrides an AI system's instructions. The attacker hides commands in a message, a document or a web page so the assistant leaves its actual task and follows the hidden command instead. The aim is often data leakage, wrong answers or unauthorised actions in the user's name.
Why the Term Matters
Once an assistant reaches a company brain or runs actions, every input becomes a possible entry point. A slipped-in sentence in an email or a PDF can push the assistant to reveal confidential knowledge. For a second brain this is serious, because that is exactly where the sensitive company knowledge sits. Whoever knows prompt injection builds boundaries before granting rights.
When It Is Relevant
- The assistant processes foreign text, such as mail, tickets or web content.
- It has access to confidential sources in the company brain.
- It may trigger actions, such as send, book or change.
- External users can send inputs to the assistant.
When Not
A purely internal tool that only processes fixed, checked text without foreign input carries small risk. An assistant without access to sensitive data and without action rights is also less exposed. That does not mean you ignore the point, but the priority is lower.
Industries That Use It
- Banks and insurers: an assistant reads customer correspondence, so every foreign message must be treated as potentially manipulative.
- Legal departments: contracts and briefs from opposing parties carry foreign text that needs checked boundaries.
- Customer support: incoming tickets come from outside and must not lure the assistant into unauthorised disclosure.
- Research and development: ingested web sources can carry hidden commands and must stay isolated.
Typical Use Cases
- A separation of system instruction and foreign content so text cannot override rules.
- An approval step for sensitive actions instead of running them automatically.
- A filter on outputs that try to pull data from the company brain.
- A test with known attack patterns before going live.
- Logging that makes suspicious inputs visible.
Decision Guide
| Signal | Defence against prompt injection needed | Alternative |
|---|---|---|
| Assistant reads foreign text | strict separation and filters | plain trust is risky |
| Access to sensitive knowledge | tight rights, check outputs | open access endangers data |
| Actions with effect | build in human approval | auto-execution is dangerous |
| Only fixed internal text | risk low | light control suffices |
Example
A team lets its support assistant summarise incoming tickets. To defend against prompt injection, the ticket text is clearly marked as foreign content, the assistant gets no rights to customer data outside the ticket, and every action needs approval. Before launch the team checks known attack sentences. This describes the method, not an asserted client metric.
Service Connection
Protection belongs in the build of a company brain from the start and in every AI agent we build for you.
Sources
This framing describes recognised patterns around prompt injection and common defence. The concrete risk and the right measures depend on the build, the rights and the sources, and must be checked case by case.
