Skip to content
Get in touch
A hand pours a speech bubble containing a pink wheeled horse into the open top of a robot's head. The robot grips a shield and wrench on stands while a padlock lies flat below.
Reviewed visual · version 1

RS Glossary

Prompt Injection

Prompt injection is an attack in which instructions placed in user input or retrieved content attempt to override, redirect, or exploit an AI system's intended instructions and tool access.

Review state
Reviewed in POC
Freshness
Current
Version
2
  • Prompt Injection
  • Indirect Prompt Injection

Remember it this wayUntrusted content tries to become trusted instruction.

In plain language

A model may encounter text that looks like a new command inside a document, webpage, email, or direct request. If the surrounding system treats that content as trusted instruction, the model may follow it.

Why it matters

Systems that read untrusted content or use tools can expose data or take unwanted actions unless permissions and trust boundaries are enforced outside the prompt.

Example

A document contains hidden text telling an assistant to ignore its task and send retrieved confidential information to an external address.

Common misconception

Prompt injection cannot be solved reliably by adding one stronger sentence to the system prompt. It requires architectural controls, limited permissions, isolation, and monitoring.

Related terms

Sources

Learn more

  • Treat retrieved content as untrusted input and preserve boundaries around [[sensitive-information|Sensitive Information]].

Public history

45 recorded events · 45 public summaries

  1. A potential shared concept was discussed and selected for initial glossary drafting.

  2. The captured candidate received a complete initial draft and entered section-level human review.

  3. Radar reviewed the initial definition draft for human consideration.

  4. Radar reviewed the initial plain-language-explanation draft for human consideration.

  5. Radar reviewed the initial why-it-matters draft for human consideration.

  6. Radar reviewed the initial example draft for human consideration.

  7. Radar reviewed the initial common-misconception draft for human consideration.

  8. Radar reviewed the initial remember-it-this-way draft for human consideration.

  9. Radar reviewed the initial related-terms draft for human consideration.

  10. Radar reviewed the initial sources draft for human consideration.

  11. Radar reviewed the initial learn-more draft for human consideration.

  12. A proposal was opened for section-level human review while preserving the current version.

  13. A human reviewer opened a proposed revision while preserving the current approved or captured version.

  14. definition approved by a human reviewer.

  15. plain-language-explanation approved by a human reviewer.

  16. why-it-matters approved by a human reviewer.

  17. example approved by a human reviewer.

  18. common-misconception approved by a human reviewer.

  19. remember-it-this-way approved by a human reviewer.

  20. related-terms approved by a human reviewer.

  21. sources returned for revision.

  22. learn-more approved by a human reviewer.

  23. Requested wording was prepared without changing approved or existing sections.

  24. Radar reviewed the pending sources section for human consideration.

  25. Radar must rereview the complete prompt-injection term after an accepted text change.

  26. Radar must rereview the complete prompt-injection term after an accepted text change.

  27. Radar must rereview the complete prompt-injection term after an accepted text change.

  28. Radar must rereview the complete prompt-injection term after an accepted text change.

  29. Radar must rereview the complete prompt-injection term after an accepted text change.

  30. Radar must rereview the complete prompt-injection term after an accepted text change.

  31. Radar must rereview the complete prompt-injection term after an accepted text change.

  32. Radar must rereview the complete prompt-injection term after an accepted text change.

  33. Radar must rereview the complete prompt-injection term after an accepted text change.

  34. sources approved by a human reviewer.

  35. sources approved wording became the current section text.

  36. All section gates are approved; content version 2 is now a fully approved term.

  37. Radar rereviewed the human-approved definition wording for this exact version.

  38. Radar rereviewed the human-approved plain-language-explanation wording for this exact version.

  39. Radar rereviewed the human-approved why-it-matters wording for this exact version.

  40. Radar rereviewed the human-approved example wording for this exact version.

  41. Radar rereviewed the human-approved common-misconception wording for this exact version.

  42. Radar rereviewed the human-approved remember-it-this-way wording for this exact version.

  43. Radar rereviewed the human-approved related-terms wording for this exact version.

  44. Radar rereviewed the human-approved sources wording for this exact version.

  45. Radar rereviewed the human-approved learn-more wording for this exact version.

Source: vault/Glossary/terms/prompt-injection/term.md · sha256:2211ed1f89190ebb401304033ddebc7dda3bd6d29e1633589dba76f788a4ccc3 · Release: rs-glossary-glossary-team-poc-0.5.5-2026-09-02