Security findings

Prompt injection

Getting a model to follow instructions that arrive inside data it was asked to process.

A model reading a web page, an email or a document cannot reliably tell the difference between content it should summarise and an instruction it should obey. Text placed in that content can redirect it.

It is the reason an agent with both broad read access and broad write access is far more dangerous than one with either alone: the first lets an attacker speak to it, the second lets it act.

Why it matters

There is no complete fix. Every practical defence is about limiting what an agent can do rather than what it can be told.

The mistake everyone makes

Treating it as a model quality problem that will be solved by a better model. It is a design problem about where untrusted text meets privilege.

Related terms

Tool poisoning

Hiding instructions inside a tool description so the model reads them as commands.

Least privilege

Granting the narrowest access that makes the job possible, and nothing beyond it.

Egress allow-list

An explicit list of the hosts a piece of software is permitted to contact.

See Prompt injection on a real listing

Every term here shows up in the catalogue next to a real result, with the findings published and the limits stated. Free to browse, no account needed.

Open the catalogue