Prompt injection hides instructions inside text the model will read.
Direct injection comes from the user typing it themselves.
Indirect injection arrives through a fetched page, document or email.
The model has no reliable way to separate instructions from data.
Defences are delimiting untrusted text, least-privilege tools and validating outputs.
Prompt injection is instructions smuggled into text the model will read as input.
The model cannot separate instruction from data, since both arrive as tokens in one stream.
That is not a bug in a particular model but a property of how they work.
Direct injection is the user typing it themselves.
They ask the model to ignore its rules, reveal its system prompt, or behave differently.
The blast radius is usually limited to that user's own session.
Indirect injection arrives inside content your system fetched.
A web page, a PDF, an email, a code comment or a calendar invite can carry it.
The user never sees it and may not be involved at all.
That is the serious case, since the attacker is not the person at the keyboard.
In an agent with tools the result is action rather than a rude reply.
Sending data to an attacker's URL is the standard demonstration.
Delimiting untrusted text and labelling it as data helps and does not solve it.
Real defence is architectural: least privilege, validated outputs and approval for anything irreversible.
Design as though the injection will eventually succeed, because sooner or later it will.
One question on this card. Every option explains itself once you pick, right or wrong.
16 concepts in this module, then a graded test with every answer explained.