When an AI assistant follows the wrong instructions.
Prompt injection becomes more serious when an assistant can act. Look at the boundary between content and authority.
Content can contain instructions
An assistant may read a document, web page or search result as part of a legitimate task. That content can also contain text that tries to redirect the assistant. Prompt injection exploits confusion between information to analyse and instructions the system is authorised to follow.
A strange answer is only one possible result. The risk depends on what the assistant can access and which tools it is allowed to use.
Keep the demonstration small
Create a fictional document and an assistant that can inspect only a folder of dummy records. Place a misleading instruction in the document, then observe whether the assistant treats it as evidence or authority. Keep the environment isolated from real accounts, email and secrets.
Record the assistant’s actual tool calls and outputs. A confident explanation is not evidence that an action happened.
Put the defence at the action boundary
Limit tools and data to the minimum needed for the task. Keep permissions separate from retrieved content. Validate tool parameters and destinations using application code. Require appropriate approval for sensitive actions and log what the system actually does.
A sentence telling a model to ignore malicious text can help set expectations, but it is not a complete security boundary.
Test the protection
Run the same controlled example after adding restrictions. Confirm that the protected tool refuses an unauthorised action, even if the model still produces an undesirable instruction. Document the assumptions and limits of the test instead of claiming that all prompt injection is solved.