01In plain English
Prompt injection is an attack on AI tools. Someone hides instructions in content the AI will read, such as a web page, an email or a document, and the AI follows them as if they came from you: leaking data, changing an answer or taking an action.
02How it works
An AI model receives your instructions and the material it is working on in one stream of text, and it cannot always tell which is which. An attacker exploits that by hiding a command inside the material. Suppose you ask an assistant to summarize your inbox, and one email contains white-on-white text saying to forward the latest invoices to an outside address. The assistant reads it along with everything else and may treat it as an order. The attacker never needs access to your account, only a way to put text where the AI will read it. The risk grows with every extra power the assistant has, such as sending, deleting or buying.
03Why it matters when you are choosing
It matters most for AI agents that browse, read email or act in other tools, because anything they read could carry instructions. It is one of the main risks of giving an agent access to your accounts.
04What to check
Ask how the tool separates your instructions from content it reads, and what the agent can do without your approval.
05Where you will meet it
06Common questions
Can prompt injection happen without hacking my account?
Yes. The attacker only needs the AI to read something they wrote, such as a web page, a shared document or an email. No password is stolen. The danger comes from what the AI is allowed to do once it follows the hidden instruction.
How do I protect against prompt injection?
No single fix exists, so layers help. Give the AI only the permissions it needs, require approval before it sends or deletes anything, keep it away from untrusted content where possible, and review logs. Vendors can also filter inputs, but treat those filters as helpful, not final.
Are chatbots without tools at risk?
Much less. A plain chatbot that only writes text can be tricked into a wrong or rude answer, but it cannot act on your accounts. The serious risk begins when the assistant can browse, read private files or take actions, because a trick then has real consequences.