Prompt injection is untrusted text trying to override your instructions.
A retrieved web page might contain ignore your instructions and do this instead.
The model cannot inherently tell instructions from data.
Direct injection comes from the user; indirect injection comes from fetched content.
Defences include clear delimiting, treating retrieved text as data, and validating outputs.
Prompt injection is text that arrives as data and behaves as an instruction.
The model has no reliable way to tell the two apart, since both are just tokens.
Direct injection comes from the user, who asks the model to ignore its rules.
Indirect injection hides in content the system fetched, which is the more serious case.
A web page, a PDF, an email or a code comment can carry the payload.
The user never sees it and the model reads it as part of its instructions.
The classic line is to ignore previous instructions and do something else instead.
In an agent with tools the consequence is action, not merely a rude reply.
Exfiltrating data through a crafted URL is the standard demonstration.
There is no known complete fix, which is the uncomfortable part.
Delimiting untrusted content and saying it is data helps and is not sufficient.
Real defence is outside the model: least privilege, validated outputs and confirmation for anything destructive.
Treat every model output that reaches a tool as attacker-controlled.
Never let retrieved content decide whether an action is authorised.
Assume the injection will eventually succeed and design so that it cannot do much.
One question on this card. Every option explains itself once you pick, right or wrong.
17 concepts in this module, then a graded test with every answer explained.