What is Prompt Injection? Definition, examples and how to stop it

Prompt injection is an attack where malicious instructions are hidden inside content that an AI application processes, so the model follows the attacker''s instructions instead of, or in addition to, the developer''s and user''s. It is widely regarded as the top security risk for applications built on large language models.

Key facts

It attacks the application around the model, distinct from jailbreaking, which attacks the model''s own safety guardrails.
Direct injection: the attacker types malicious instructions into the AI. Indirect injection: the instructions hide in external content (a web page, document or email) the AI later reads.
Indirect injection makes email and documents an attack surface: an AI assistant that reads your inbox can be hijacked by text planted in a received message.

Direct vs indirect injection

Indirect injection is the one that should worry security teams: as AI assistants gain access to mailboxes and documents, attacker-controlled text in a single received email can attempt to redirect what the assistant does, exfiltrate data it can read, or trigger actions it can take. This page explains the concept; it does not provide working injection payloads.

Why it matters as AI enters the inbox

The more capable and connected an AI assistant is, especially one with OAuth access to mail and files, the higher the stakes of a successful injection. This is the intersection of prompt injection with shadow AI: unsanctioned AI tools connected to corporate mailboxes are both an access risk and an injection surface nobody is monitoring.

How to defend

At the application layer: treat all ingested content as untrusted, constrain what the AI can do, separate instructions from data, and require confirmation for sensitive actions. At the organizational layer: control which AI tools get access to mail and files (the shadow AI problem), and monitor the OAuth grants that give AI assistants their reach. Sentaro contributes the second half: visibility and control over which AI apps hold access to your email environment, and detection of the phishing that plants malicious content in the first place. See also agentic AI security.

Questions we get asked.

What is prompt injection in simple terms?

Hiding instructions in content an AI reads so the AI does what the attacker wants. Like social engineering, but the target is the AI application rather than a person.

What is the difference between prompt injection and jailbreaking?

Jailbreaking manipulates the model''s own safety rules; prompt injection manipulates the application by smuggling instructions through the data it processes. Different layers, both defeat intended controls.

What is indirect prompt injection?

When the malicious instructions are hidden in external content (a web page, document or email) that the AI ingests later, rather than typed directly by the attacker. It turns AI-read content into an attack channel.

How does prompt injection relate to email security?

AI assistants connected to mailboxes can be targeted by injected instructions inside received emails, and unsanctioned AI tools with mailbox access widen the risk, linking prompt injection to the shadow AI problem.