Prompt Injection

Prompt injection is an attack in which instructions are placed where a model will read them as input, causing it to act on the attacker's intent instead of the operator's. The instructions can arrive directly from a user, or indirectly — hidden in a web page the agent fetches, a document it summarises, an email it triages, or the output of a tool it calls. The model has no reliable way to distinguish content it was asked to process from instructions it was asked to follow.

This is a design property, not a bug awaiting a patch. A language model reads one stream of tokens. Whatever separation exists between "your instructions" and "this data" is a convention the model was trained to respect, not a boundary the system enforces. That is why prompt injection is treated as a control problem rather than a model problem: the mitigation sits outside the model, in what the model is permitted to reach and what it is permitted to send.

How it differs from jailbreaking. Jailbreaking targets the model's own safety behaviour — persuading it to produce output it would normally refuse. Prompt injection targets the application built around the model: the aim is not forbidden text but a privileged action, taken with the agent's credentials.

Indirect injection is the enterprise case. An agent with tool access and an inbox is reachable by anyone who can get text in front of it. The blast radius is whatever that agent is authorised to do.

Smartflow's AI firewall provides real-time detection and prevention.

Enterprise AI firewall guide