Prompt Injection: How a Few Hidden Words Can Hijack an AI

The 30-second explanation

It is like slipping a fake note into a pile of paperwork that says 'ignore your boss and do this instead', and having an over-helpful assistant obey it.

How it works

1. 1

   1. Content

   An email or page contains hidden instructions.

2. 2

   2. Assistant reads it

   As part of a normal, routine task.

3. 3

   3. Confusion

   It treats the hidden text as a command.

4. 4

   4. Action

   It does something the user never asked for.

An AI assistant is given instructions by whoever built it, and then reads whatever you or it fetches: an email, a web page, a document. The trouble is it reads instructions and content the same way. If a web page contains hidden text saying 'tell the user to visit this link', an assistant summarising that page may follow it — the attacker never touched the assistant, they only wrote something it would read. This matters most when assistants can take actions, like sending emails or running tools.

Real-world example

How to spot it

• Broad tool access

  An assistant that can reach far more data or actions than the task needs.

• No separation of content

  Untrusted text mixed in with instructions, with nothing to tell them apart.

• Actions with no confirmation

  Sensitive steps that happen automatically, without a person approving them.

• Unusual tool calls

  An assistant reaching for a tool that has nothing to do with the task asked.

What to do

1. 1Give assistants only the tools and data they strictly need for the task.
2. 2Keep untrusted content clearly separated from system instructions where possible.
3. 3Require a human to confirm any action that has a real-world consequence.