Hiding instructions in content an AI reads, to make it do something it shouldn't.
AI models can struggle to tell the difference between what their user asked and instructions in text they come across while working. Prompt injection exploits that gap by hiding commands like "ignore your previous instructions and do this instead" inside a web page, email or document. Developer Simon Willison gave the attack its name in 2022.
A jailbreak dodges an AI's safety rules; prompt injection hijacks an app's instructions. A user can do it, but the bigger risk is a third party hiding a trap in what the AI reads, especially for agents that send emails or open files. There's no complete fix yet, so have a person check anything important.
Think of it like this
Say you ask a friend to grab your maths book from your locker. Someone has stuck a note inside saying "whoever reads this, bring the wallet too", and your friend obeys it. Prompt injection is hiding that kind of note where an AI will read it.
For example
White text on a white background is invisible to you, but an AI reading the page sees it, and may follow it.
Records about this
Source-checked moments from AI history.
Became the practical checklist of agent security discussions. Vendor documents and security guides adopted the three-part distinction as is
Publicly demonstrated that in a live service the system prompt does not work as a line of defense
Foundational vocabulary of the LLM security field. Every later security framework, including the OWASP LLM Top 10, uses the term