Prompt injection is an attack in which instructions are placed where a model will read them as input, causing it to act on the attacker's intent instead of the operator's. The instructions can arrive directly from a user, or indirectly — hidden in a web page the agent fetches, a document it summarizes, an email it triages, or the output of a tool it calls. The model has no reliable way to distinguish content it was asked to process from instructions it was asked to follow.
This is a design property, not a bug awaiting a patch. A language model reads one stream of tokens. Whatever separation exists between "your instructions" and "this data" is a convention the model was trained to respect, not a boundary the system enforces. That is why prompt injection is treated as a control problem rather than a model problem: the mitigation sits outside the model, in what the model is permitted to reach and what it is permitted to send.
How it differs from jailbreaking. Jailbreaking targets the model's own safety behavior — persuading it to produce output it would normally refuse. Prompt injection targets the application built around the model: the aim is not forbidden text but a privileged action, taken with the agent's credentials.
Indirect injection is the enterprise case. An agent with tool access and an inbox is reachable by anyone who can get text in front of it. The blast radius is whatever that agent is authorized to do.
Smartflow's AI firewall provides real-time detection and prevention.
Defenses that survive contact
Input filtering alone does not hold, because the attack is not a string to be matched — it is instruction-shaped content arriving through a channel the model was told to trust. The defenses that survive are architectural: constrain what the model is permitted to do rather than what it is permitted to read.
In practice that means scoping tool access so a successful injection reaches a small blast radius, inspecting the output path as well as the input path so exfiltration is caught even when the prompt was not, and treating content retrieved from documents, web pages and MCP tool responses as untrusted regardless of where it came from. The enterprise AI firewall guide covers inline inspection, agentic governance the scoping, and APERION Shield the local runtime case. Output-side controls overlap with DLP for AI, and the agent case is set out under agent governance.
Related terms
DLP for AI · Model Context Protocol (MCP) · A2A (agent-to-agent protocol) · Runtime governance · Indirect prompt injection · Full glossary
Put this in the path of your own agents.
Policy enforced inline between your agents and every model and tool they reach, with a record bound to the human who owns it.
Request a Demo Read the docs