What is prompt injection?
A short, plain definition — plus the difference between direct and indirect attacks, and what actually catches each one today.
Prompt injection is any attempt to make an AI model follow an instruction its operator didn't intend, by hiding that instruction inside the model's input. Direct injection comes from the user typing it themselves; indirect injection arrives inside content the user never wrote, like a webpage or document the AI reads on their behalf.
Last updated:
The definition
Prompt injection is any attempt to make an AI model follow an instruction its operator didn't intend, by hiding that instruction inside the model's input rather than presenting it through an approved interface. An LLM sees one flat stream of text — it has no reliable structural way to tell "this is the system prompt", "this is the user's question", and "this is a document the user pasted" apart. Text that looks like an instruction tends to get treated as one, wherever it came from.
Direct vs. indirect
The same underlying weakness, reached two different ways.
Direct injection
The user types the adversarial text themselves — "ignore your previous instructions and…", a jailbreak persona, a request to reveal the system prompt. It's the easier half of the problem: the input is at least coming from a party you can be suspicious of.
Indirect injection
The instruction arrives inside content the user never wrote — a webpage they asked to be summarised, a forwarded email, a document a retrieval system pulled into context. The user did something entirely reasonable, and the model read an instruction the user never saw. Often invisible in the surface the user sees: an HTML comment, white text on white, or a zero-width character.
Why it matters for enterprises
Because an assistant that reads pasted content can be steered by whoever wrote that content, not just by the person doing the prompting.
The moment an AI tool can read a webpage, a support ticket, or a document someone else authored, the attack surface stops being "what your own employees might type" and becomes "what anyone who can get text in front of that document might have written." That's a much larger, much less controllable set of authors.
What actually detects it today
Published the same way everything else on this site is: what's shipped, and what isn't yet.
Regex and heuristic detection for both direct injection (instruction-override and jailbreak phrasing) and indirect injection (instructions inside comment syntax, embedded role markers, text addressed directly to "the AI", and hidden carriers like zero-width characters) is implemented and running in the extension today, alongside detection for base64 and other encoding tricks used to slip a payload past literal matching.
What this doesn't catch: a semantic attack phrased as ordinary prose, with no comment syntax and no role marker to match against. That's what the on-device ML classifier is for — it's implemented and tested, and it stays switched off until a real model backs it, because we'd rather ship nothing than a classifier that returns a plausible-looking constant.
Find out what your team is
already sending to AI.
The first week of telemetry usually answers that better than any policy document. No credit card, no commitment — you reach the founding team directly.
Want to see it on your own team before talking price? Join the Design Partner Program — free for 30 days