Prompt Injection
The attack where untrusted content — a web page, an email, a retrieved document — carries instructions the model mistakes for its operator's, steering an agent to leak data or misuse its tools.
Production AI is a system: context, tools, permissions, traces, evals, and feedback loops around the model.
What it is
Language models do not natively distinguish instructions from data: any text that enters the context can try to redirect the model. Direct injection comes from the user; indirect injection hides in content the agent reads — a web page, an email it was asked to summarize, a document in the retrieval index. OWASP ranks prompt injection as the top LLM application risk (LLM01).
Why it matters
For a chatbot, injection produces a bad answer. For an agent with tools, it produces actions: exfiltrating data through a tool call, sending an email, modifying a record. The tool surface turns a text vulnerability into capability abuse, and no complete fix exists — defense is layered, not solved.
How we defend
A policy rule the runtime enforces — untrusted content is never instructions — plus tool permissions scoped per agent with deny-over-ask-over-allow resolution, approval gates on writes, egress controls with an operator kill switch, and traces that make an attempted injection visible after the fact.
Related resources
The safety checks and policy enforcements that sit around an AI agent's inputs and outputs — content filters, scope enforcers, PII redactors, refusal patterns, and tool-call validators.
Each AI agent gets its own limited set of keys — it can only use the tools its job requires, with credentials that are scoped, temporary, and tracked.
A point in an AI workflow where an action is suspended until a human reviews and approves, rejects, or modifies it.
The policy layer for what an AI system is allowed to read, call, decide, and ship — encoded as configuration the runtime enforces, not as a document on a shared drive.