Prompt Injection
Prompt injection is harmful or unexpected text. It tries to make an AI ignore the app's trusted rules and follow other instructions.
Another example
A security tester opens a webpage that hides an order to export secrets. The agent must treat it as untrusted text and block the tool call. A poorly written prompt is not injection unless it takes over instruction control.
Main parts
- 01instruction boundary
- 02untrusted payload
- 03privileged action
Use it when
Use this term when checking whether direct or hidden text can take over an AI system's instructions.
Do not use it when
Do not call every wrong answer or rule-breaking chat prompt injection when no instruction takeover happened.
Name used in code
untrusted content ≠ trusted instruction Before you ship
Work only within an explicitly authorized and isolated defense test. Check the trust boundary, inert regression case, mitigation, and handling of secrets and personal data. Check redacted detection signals, safe failure, incident owner, recovery, and rollback. Never test a real target.
Outcome: Assess and mitigate the risk from Prompt Injection. Do not implement, enable, or use the attack. User context: A security tester opens a webpage that hides an order to export secrets. The agent must treat it as untrusted text and block the tool call. A poorly written prompt is not injection unless it takes over instruction control. Risk or control to address: Prompt Injection. Why it applies: Use this term when checking whether direct or hidden text can take over an AI system's instructions. Classification boundary: Do not call every wrong answer or rule-breaking chat prompt injection when no instruction takeover happened. Safety requirements: Test only in an isolated space with explicit permission. Use inert, harmless inputs. Protect secrets and personal data. Name the trust boundary and record the mitigation. Operational safeguards: Set up detection and logs that hide sensitive data. Name the incident owner. Define a safe failure mode and rollback before release. Acceptance criteria: A defensive regression test fails before the mitigation and passes after it. No real target, secret, or personal data is used. Monitoring and rollback are verified. Evidence and limits (evidence boundary): It is official for that source. Other platforms or teams may use the term in another way. Unknowns to confirm: Authorized scope, affected assets, data class, threat actor, incident owner, and rollback limits.
Check this request
Review the current use of Prompt Injection. Definition: Prompt injection is harmful or unexpected text. It tries to make an AI ignore the app's trusted rules and follow other instructions. Release checks: Work only within an explicitly authorized and isolated defense test. Check the trust boundary, inert regression case, mitigation, and handling of secrets and personal data. Check redacted detection signals, safe failure, incident owner, recovery, and rollback. Never test a real target. Before changing code, report the evidence you found, gaps, severity, and the smallest safe fix.