Prompt injection is an attack on a system that uses AI: someone plants orders in a text the model will read, so that it ignores your instructions. It is direct when the user writes it, and indirect when it arrives hidden in an email, a web page, a document or the response from a tool.
In practice
Anthropic separates the two cases. In the direct one, the user of your application is the adversary. In the indirect one, the user is trusted, but the model processes third-party content: the body of an inbound email, a web page, the text extracted by OCR from an uploaded file or the result of a tool call. Whoever controls that content can plant orders to redirect the model.
The Spanish Data Protection Agency (AEPD) gives a clear example: an email with white text on a white background, invisible to a person, which an agent obeys while summarising it. In a small business, the risk appears wherever an AI agent reads what anyone sends:
- The shared inbox the agent sorts and replies from.
- The PDFs from suppliers or customers it extracts data from.
- The web pages it checks to prepare an answer.
- The documents behind an assistant that uses RAG.
There is no complete fix. OWASP, in its 2025 list of risks, puts it first and notes that neither RAG nor fine-tuning fully prevents it. That is why the AEPD proposes its "rule of 2" (regla de 2): an agent that reads content from anyone, accesses sensitive information and acts on its own is a set-up that should not be allowed. If it reads outside email, it should not act without human supervision.
The measures Anthropic and OWASP recommend:
- Treat outside content as untrusted data, kept apart from your instructions, and tell the model where it came from.
- Give the agent the least access possible, so that a trick that works does as little damage as possible.
- Require human approval for risky actions.
- Screen what tools return before the model acts on it.
- Test the system with emails and documents that try to trick it, before launch and afterwards.
Common mistakes
- Thinking it only affects public chatbots. The most dangerous case is internal: an agent with access to your email or CRM that reads a message from outside.
- Mixing outside content with your instructions. If the email text sits in the same block as your orders, the model has a harder time telling them apart.
- Letting it pay, delete or send sensitive data on its own. INCIBE, Spain's national cybersecurity institute, recommends that an AI never does these things by itself and that it can be stopped quickly.
There are more examples in AI agents for business and automating business processes with AI.