Prompt injection is the security issue most likely to affect businesses adding AI features this year, and it is widely misunderstood as an exotic research problem. It is neither exotic nor solved.

The core problem

A language model receives everything as text: your instructions, and the content it is asked to process. It has no reliable way to distinguish between the two. If your assistant summarises incoming email, and an email contains text addressed to the assistant instructing it to do something else, the model may follow those instructions. The attacker is not breaking into anything — they are simply sending you content.

Where this matters

  • An assistant that reads customer emails or support tickets and can send replies.
  • A tool that summarises documents or web pages supplied by other people.
  • An agent with access to your calendar, files, or internal systems.
  • Any workflow where model output triggers an action without a person reviewing it.

What an attack looks like in practice

A message contains instructions buried in the body, sometimes hidden in white text or an attachment. The assistant, summarising it, follows them: forwarding a thread to an external address, revealing content from other documents it can access, or taking an action on the attacker's behalf. The user sees a normal summary and nothing obviously wrong.

What actually reduces the risk

Not better prompting. Instructions telling the model to ignore injected instructions are themselves text, and they can be overridden. The controls that work are architectural: limit what the assistant can reach, separate reading from acting, require human confirmation before anything irreversible, and treat model output as untrusted input to whatever consumes it next.

Practical rules if you are building with this

  • Give the assistant the narrowest possible permissions — read-only wherever it suffices.
  • Never let model output directly trigger a payment, a send, a delete, or a permission change.
  • Keep untrusted content out of contexts where the model holds sensitive data.
  • Log what the model was shown and what it did, so an incident is investigable.
  • Confirm irreversible actions with a person, showing them what will happen.

If you are only using AI, not building with it

The exposure is smaller but real: be cautious about connecting assistants to your mailbox or file storage, and review what permissions any AI integration requests before approving it. A browser extension or plugin with full page access is a substantial grant.