Prompt injection

How does prompt injection work?

A language model reads your instructions and the text it is working on as one stream of words, and it cannot reliably tell the two apart. OWASP defines prompt injection as input that changes a model’s behaviour or output in unintended ways, and says the input does not have to be readable by people as long as the model parses it.

There are two forms. In direct injection, the person typing to the AI supplies the instructions. In indirect injection, the instructions sit in outside content the AI reads, such as a web page, email or shared file. Google describes indirect injection as hidden instructions in external data, aimed at making the AI leak data or take actions its user never asked for.

Why does prompt injection matter for a small business?

The risk grows with what your chatbot or agent can reach. A bot that only answers questions from public pages can be nudged into saying odd things. An agent connected to email, a CRM or payment tools can act on a stranger’s text using your permissions.

No defence removes the problem entirely, so the practical response is to limit access, use narrow credentials and require human approval for risky actions. The full explanation, with examples, is in Prompt injection explained for businesses using chatbots and agents. The pre-launch review is in the AI agent security checklist.