# Prompt injection

> Prompt injection is an attack where malicious text, from a user or a document, tries to make the LLM ignore its original instructions and do something else.

## Direct and indirect

- **Direct:** the user types "ignore previous instructions and…".
- **Indirect:** the malicious instruction hides in a web page, email or PDF the system reads.

## Reducing the risk

- Treat all retrieved content as **data**, never as instructions.
- Give the model only the tools and permissions it strictly needs.
- Require human approval for irreversible actions.
- Monitor and log inputs and outputs.

There's no perfect defense: design the system assuming injection will happen.