Glossary
Prompt injection
An attack where text an AI model reads, such as an email, web page or document, contains instructions that the model then follows.
Also called Indirect prompt injection.
In plain terms
Language models read instructions and data through the same channel, as text. If an attacker can get text in front of the model, they can try to give it orders.
The indirect form is the dangerous one for agents. The attacker never talks to the AI directly; they plant instructions in a ticket, an issue or an email that the agent will read later, while it holds tools and access.
See what happens without it
The failure pattern this protects against, indirect prompt injection changes agent behavior, played out step by step.
Scroll the diagram sideways to see every system.
It posts the secrets where the attacker can read them.
What goes wrong:
- An attacker hides instructions inside an ordinary support ticket.
- A developer asks the assistant to summarise new tickets.
- The assistant obeys the ticket and reads the private tables.
- It posts the secrets where the attacker can read them.
With the safeguard:
- An attacker hides instructions inside an ordinary support ticket.
- The ticket text reaches the assistant as data to summarise, never as orders.
- Its tools cannot reach private tables, so the injected request is refused.
- Nothing leaves, and the ticket is flagged for review.
When it mattered
In 2025 researchers showed that a malicious issue on a public repository could make an MCP-connected agent read private repositories and leak their contents in a pull request.