Prompt injection: who’s giving your AI its orders?

“Could someone hijack the AI feature we built for the client?” Yes, they could. The usual way in is quieter than a stranger typing at the chat box. Someone hides an instruction inside something the Artificial Intelligence (AI) reads, like a web page, an email or a shared document, and the AI follows it. That is prompt injection. It sits at the top of the security list for apps built on a Large Language Model (LLM).

What is prompt injection, in plain terms?

Anthropic describes prompt injections as adversarial instructions hidden within the content that AI models process¹. They come in two kinds. The direct kind is the user as attacker: OWASP, the open security project that keeps the standard list of LLM risks, describes it as user prompts alter the LLM’s behavior or output in unintended ways². The indirect kind is the one agencies should lose sleep over. The user is trusted, and the attack rides in on third-party content (web pages, emails, documents, tool results) that contains adversarial instructions³.

Why does it work at all? Go back to context⁴. Everything a model sees before it answers arrives as one stream of text: your instructions, the documents it retrieved, the results of its tools, the chat so far. Most software keeps commands and data in separate lanes. A language model reads both in the same lane, so a sentence that sounds like an order can be taken as one, wherever it came from.

Why don’t people see it coming?

Anthropic walks through a routine case. You ask an AI agent to read your recent emails and draft replies to meeting requests. One email, ostensibly a vendor inquiry¹, carries instructions in white text, invisible to you but processed by the agent¹. They tell it to forward any email containing the word “confidential” to an outside address before it drafts the replies. You never see the order. The agent does.

The planted order doesn’t even have to be words on a page. Anthropic’s own screening looks for commands disguised as hidden text, manipulated images, deceptive UI elements¹, which covers the text you can’t see, the doctored picture, and the fake button on a user interface (UI). Anything the model can read is a place to hide one.

Why is there no complete fix?

The weakness is the same trait that makes the model useful: it follows instructions written in plain language. The labs say so openly. OpenAI writes that prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully “solved”⁵. Anthropic calls it far from a solved problem, particularly as models take more real-world actions¹. OWASP’s verdict is shorter: it is unclear if there are fool-proof methods of prevention².

Defenses are improving, and one vendor’s numbers show both halves of that. In Anthropic’s browser-agent testing, published in November 2025, an attacker given 100 attempts in each test environment got through about 1% of the time against the latest model and safeguards. That is the company’s own measurement, and its gloss on its best score is that it still represents meaningful risk¹. One in a hundred is a fine rate for a spam filter. It’s a poor one for an assistant that can send a client’s files.

Which setups carry the most risk?

The developer and writer Simon Willison gives the clearest test. He calls it the lethal trifecta⁶: an AI agent with access to private data, exposure to untrusted content, and the ability to communicate externally. Give one feature all three and a planted note can make it gather the data and send it out. Take away any one leg and that route to theft closes. This is also why AI shopping agents, which read product pages and reviews written by strangers on a buyer’s behalf, are the clearest real-world test of the problem.

Since nobody can promise to stop every planted note, the practical goal shifts: make a fooled AI unable to do much harm. Anthropic’s guidance for developers lays out the layers. Mark outside content clearly, and tell the model that such content is untrusted data and must never override the system prompt or the user’s original request³. Screen what tools bring back before the model acts on it. And apply least privilege so that a successful injection can do minimal damage³.

What's Real?

• •It is the top-ranked risk. OWASP puts prompt injection² first on its list for LLM apps, and the indirect kind only needs access to something the AI will read.
• •No lab claims a cure. OpenAI expects it to stay unlikely to ever be fully “solved”⁵, and Anthropic says no browser agent is immune to prompt injection¹.
• •Defenses cut the odds. Anthropic trains its models on injected examples and scans all untrusted content that enters the model’s context window¹, and still reports a share of attacks getting through.
• •The damage depends on what the AI can reach. A fooled assistant that only drafts text is a nuisance. One that holds private data, reads strangers’ content and can send messages has the full trifecta⁶.
• •A person on the consequential step still works. OWASP recommends that teams implement human-in-the-loop controls for privileged operations²: a human in the loop approves the action before it happens.

The “so what” — for anyone serving tech clients

• •Ask every vendor three questions. What outside content does the feature read? What can it reach and do if that content fools it? Which actions need a person to approve them? A vendor with clear answers has thought about this. One who says the model can’t be tricked has not.
• •Break the trifecta by design. If a feature has to read the open web, keep it away from client data, or take away its ability to send anything out. That is a scoping decision you can make before anyone writes code, and it belongs in the proposal.
• •Put a person on the step that matters. Drafts can flow freely; sending, paying, publishing and deleting wait for a human. It is the same last-mile review as brand safety⁷, applied to what the AI does.
• •Test it with planted notes. Anthropic’s advice to builders is to red-team your own agent³: feed it documents and emails that carry injection attempts before launch. Budget to do it again whenever the feature changes.