Prompt Injection Explained: How the Attack Works and How to Defend Against It

Prompt injection is an attack in which text supplied to an AI system is written to override its instructions. A language model reads its instructions and the content it is working on as one stream of text, and it has no reliable way to tell which parts are orders and which are data. An attacker who can get text in front of the model, by typing it or by hiding it in a document, web page or email the model later reads, can try to make it ignore its rules, reveal information or misuse the tools it is connected to. There is no complete fix today. The practical defence is to limit what the model is able to do, so that a successful injection achieves little.

How does a prompt injection attack work?

Indirect injection is the more serious problem for businesses, because the person using the assistant has done nothing wrong. They asked for a summary of an email; the email contained the attack.

Why can't the model simply be told to ignore it?

Because the instruction to ignore injections is itself just more text in the same stream. Models are trained to follow instructions, and a well-crafted injection looks like one. Filters that scan for suspicious phrases help against known patterns, but attackers rephrase, translate, encode or split their text. The Open Worldwide Application Security Project lists prompt injection first in its Top 10 risks for LLM applications, and its guidance treats it as a risk to be contained, not eliminated.

Source: OWASP Top 10 for Large Language Model Applications. Compiled 11 Nov 2026.

What damage can it do?

The damage depends almost entirely on what the model is connected to.

The dangerous combination is a system that can read untrusted content, reach private data and communicate outward. Remove any one of the three and most attacks lose their payoff.

Treat the model as a capable but gullible intern. You would not give an intern the company chequebook and tell them to follow any instruction found in the post.

What defences actually work?

1. Least privilege. Give each assistant only the tools and data its job needs. A summariser does not need to send email.
2. Enforce permissions outside the model. Retrieval should return only documents the asking user may see. Never rely on the model to withhold. See RAG vs fine-tuning vs long context.
3. Human approval for consequential actions. Sending, deleting, paying and publishing should need a click from a person who can see exactly what will happen.
4. Separate trusted and untrusted content. Mark retrieved text clearly as data, and consider a second model without tool access to process untrusted content.
5. Block the exit routes. Restrict which outside addresses the AI server and its tools can reach. Egress filtering at the firewall stops many exfiltration tricks regardless of what the model was persuaded to do.
6. Filter inputs and outputs. Useful as one layer, not as the defence.
7. Log everything. Prompts, retrieved documents, tool calls and outputs, so an incident can be reconstructed. See AI monitoring and observability.
8. Test it. Try to break your own assistant before someone else does, and repeat after every change.

Tool connections deserve particular care. Each connector added through a standard such as the Model Context Protocol widens what a successful injection can reach.

Does running AI locally help?

Partly. A local model is just as easy to inject as a cloud one. What changes is control of the surroundings: the AI server sits on your network, behind your firewall, with your egress rules, your logs and your permission system. Data that is exfiltrated still has to leave through a path you manage. Local deployment narrows the blast radius; it does not make the model resistant. For the wider picture see is your AI assistant your biggest security risk and our security hardening checklist.

Buying in Singapore

To put the AI server on its own network segment with outbound filtering, the Fortinet FortiGate 70G (S$1,668) or, with 10GbE ports, the FortiGate 90G (S$3,796.80). To keep the assistant and its data on your premises, the NVIDIA DGX Spark 4TB (S$9,450) or ASUS Ascent GX10 1TB (S$10,350) (listed 11 Nov 2026; prices change; ask for a current quotation). To start, use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.

Frequently asked questions

What is prompt injection? Prompt injection is an attack where text given to an AI system is crafted to override its instructions, so the model follows the attacker's directions instead of its operator's.

What is indirect prompt injection? It is an injection hidden in content the model reads on a user's behalf, such as a web page, document or email. The user does not type the attack and may never see it.

Can prompt injection be fully prevented? Not with current models. Filters reduce known attacks but can be bypassed. The reliable approach is to limit the model's permissions and require human approval for consequential actions.

Is a local AI model safe from prompt injection? No. Local models can be injected like any other. Running locally gives you control over network access, permissions and logging, which limits what an attack can achieve.