What Is Prompt Injection?
Key takeaways
- Direct prompt injection is a hostile instruction typed by a user; indirect prompt injection is a payload hidden in content the model reads, and the indirect form is the one that scales.
- A retrieval-augmented system is exposed because a document the model reads can carry instructions, and the model may follow the document instead of the operator.
- The root cause is that instructions and data share one channel, so no filter reliably separates them and the fix has to be architectural rather than a blocklist.
- An AI system with a tool connection turns a bad answer into a real action, so restrict the tools, scope the credentials, and require approval for anything that changes data.
- Treat every prompt as untrusted input and log it, because the payloads are the evidence you need when an agent does something you did not ask for.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is prompt injection and how does it differ from jailbreaking?
Prompt injection is any attempt to make the model behave in a way the operator did not intend by inserting crafted text into the interaction. A jailbreak is a special case: a set of instructions designed to get a model to shed its safety behaviour. Injection is broader, because the model may be following the attacker's instruction faithfully and still causing harm. A chatbot that writes a bad paragraph is an embarrassment. A model with a tool connection, a payment authorisation or access to a customer database is a security problem, and the injection becomes the delivery mechanism for a data breach or a fraudulent action.
What is the difference between direct and indirect prompt injection?
Direct injection comes from the person typing into the interface: they ask the model to ignore its instructions, to reveal its system prompt, or to act outside the intended scope. It is bounded by how many users you have. Indirect injection is embedded in content the model pulls in, such as a web page, a PDF, a shared document, an email body, a support ticket, a resume or a database row. The model reads the payload as instructions and acts on them. This is the version that matters for a business, because a single poisoned document can affect every user who queries the same knowledge base, and because the payload arrives through channels the security team already trusts.
Why is filtering not a reliable fix?
Filtering fails for a structural reason: the model has one input channel and no reliable way to distinguish an instruction from data. Filters work by pattern and by refusal training, and attackers adapt. Prompt variations, encoding tricks and multi-step instructions all exist to slip past pattern matching, and every model release invalidates some of the tuning. The durable defence is to change the design rather than the blocklist. Give the model the smallest set of tools it needs, with credentials scoped to the task, separate retrieved content from the instructions in a way the model can be tested against, validate the output before it reaches a system of record, and require human approval for any irreversible action.
What should an Indian company do before deploying an AI agent?
Run a specific assessment before the agent touches production data. Ask for the model, the system prompt, the tool list, the credential scope and the data retention position, and read the vendor's terms on training on your inputs. Then test the agent against indirect injection: feed it a document with a hidden instruction, a hostile web page, a support ticket that asks it to disclose data, and a tool call that would move money. Write the results down, because CERT-In's 28 April 2022 directions already expect an Information Security Management System, access control and audit trails. Under the DPDP Act 2023, personal data fed into a model still has to be protected and deletable.
| Attack type | Where the payload sits | Impact | Primary control |
|---|---|---|---|
| Direct injection | Typed by the user into the interface | Confused or unsafe response | Scoped tools, output validation, user verification |
| Indirect injection in documents | A PDF, ticket or shared file the model reads | Data leakage, manipulated answers | Sanitised corpus, treated content as untrusted |
| Indirect injection on the web | A page the agent fetches | Attacker-controlled instructions | Fetch controls, allowlists, output checks |
| Tool misuse | A connected tool invoked with attacker parameters | Real actions, fraud, data loss | Least privilege, credential scoping, human approval |
| Memory and poisoning | Persistent content in a store the agent reuses | Repeated, hidden influence | Write controls on the store, retention limits, review |
What are the frequently asked questions?
Get a straight answer on this
Send us the AI tools your team has started using, and we will return a fixed-price prompt injection assessment with a test set and a least-privilege design for each agent.
Send us the details See pricing