TOPIC 04 OF 05
Prompt injection and unsafe tool use
Content can contain instructionsA connected AI may read webpages, emails, documents, or tool results that contain instructions attempting to override its task. If the system can access data or take actions, untrusted content can become an indirect route to those capabilities.
A research agent opens a webpage containing hidden text telling it to ignore the user, reveal stored information, and send a message. The page is data to analyze, not an authority that may redefine the task.
A stronger system prompt is not a complete defense. Separate data from instructions and restrict tools, destinations, credentials, and high-impact actions outside the model.
Constrain permissions, isolate untrusted content, validate tool inputs and outputs, require approval for consequential actions, and test adversarial examples.