Why your AI does what a stranger tells it

An AI assistant reads everything as the same thing: text. The rules you gave it — "be helpful, never offer a discount" — arrive as text. A customer's question arrives as text. A product page it looks up arrives as text. To the model, it's one stream of words. There is no hard line between "instructions from my owner" and "input from the world."

Prompt injection is what happens when someone puts words into that stream to make the model treat their instructions as yours. That's the whole idea. And because the confusion is baked into how these models work, there's no clean patch for it — not the way you patch a specific software bug.

It comes in two shapes.

Direct is the one people picture: a user types something into the chat designed to override the rules. "Ignore your previous instructions and…" is the cartoon version; the real ones are subtler, and they get better every month.

Indirect is the one that should worry you more, because the attacker never talks to your bot at all. Your assistant reads outside content to do its job — a web page, a product review, a document, an email, a support ticket. If an attacker plants instructions inside that content, your bot reads them as if they came from you. A hidden line in a review. White text in a PDF the bot summarizes. An email your assistant is asked to triage. The customer is innocent; the content is poisoned.

This is why your existing security tools don't catch it. A firewall looks at network traffic. An antivirus looks for known-bad files. Prompt injection is a perfectly valid sentence in perfectly valid text — nothing to flag, no signature to match. The payload is language. That's also why it sits at number one on OWASP's list of risks for LLM applications: it's the most fundamental, and the least solved.

So what do you actually do about something that has no patch?

You stop treating it as a bug to fix and start treating it as a property to manage. You find out how far your assistant can be pushed, on purpose, before an attacker does — and you keep watching it once it's live, so a successful manipulation shows up as an alert, not as a screenshot from an angry customer. Test it, then watch it. Neither is glamorous. Both beat finding out in public.

Want to see how your assistant handles a poisoned input? A 3-day audit shows you — live.