Direct vs. indirect prompt injection
Direct prompt injection comes from the person talking to the system themselves – they openly try to override the system instructions ('Ignore all previous instructions...'). The indirect variant is considerably more dangerous: the attack text isn't in your own input, but in a document, email, or web page the system processes on your behalf. The system can wrongly follow that foreign text as an instruction, even though nobody interacting with the system typed it themselves.
A documented increase, not a fringe phenomenon
Prompt injection attacks on AI agents tripled in 2024 – a trend that's intensifying rather than fading as agentic tooling spreads. According to current security analyses, prompt injection remains the most common driver of failed agentic security in production – not exotic zero-day flaws, but this one, well-understood attack vector.
Why the problem is structural, not just a bug
Language models don't reliably distinguish on their own between 'instruction I should follow' and 'content I should merely process' – both arrive as the same text. That missing separation is exactly what makes prompt injection a structural problem of the technology, not a programming error you could fix once and be done.
Practice section: defense in layers
No single building block fully solves the problem – effective defense combines several layers. Input and output checking filters obvious manipulation attempts before they reach the model or before an output turns into an action. A clear instruction hierarchy treats processed content (emails, documents, search results) technically differently from system instructions, instead of weighting both the same. And – most importantly – least privilege per tool: an agent that can only read can, at worst, output wrong information through injection, but can't cause real damage. The rights question is deepened in a later module of this course on architectural defense.