The quick read
- Separate trusted instructions from retrieved material.
- Use harmless examples containing obvious conflicting instructions and inspect both the response and tool calls.
Recognise the boundary
A webpage, email or document may try to redirect the assistant, override its task or trigger unrelated actions. That is the central prompt-injection problem: data being treated as an instruction source it was never authorised to become.
Limit the consequences
Separate trusted instructions from retrieved material. Restrict tools to the permissions needed for the task and validate proposed actions in application code. An assistant summarising a document should not acquire permission to send messages because the document asks it to.
Test the complete workflow
Use harmless examples containing obvious conflicting instructions and inspect both the response and tool calls. For a research assistant, a test page might ask it to abandon summarisation and invent a conclusion. Check that the authorised task continues and that unsupported content is not presented as evidence. Defence requires several layers, including access control and careful tool design. One warning sentence in a prompt cannot guarantee correct handling of every adversarial document.
Sources & notes
AI-assisted editorial content checked against the linked sources.
genai.owasp.org — official reference
Sources reviewed for the September 2026 launch edition.