Prompt Injection: Treat Retrieved Text as Untrusted Input

Prompt injection happens when attacker-controlled input changes an AI application’s behaviour. The input may arrive through a direct message or indirectly through retrieved documents and tool results. OWASP notes that RAG and fine-tuning do not eliminate the problem, so application controls must limit the consequences.

What matters

• Separate trusted instructions from external content, while recognising that separation alone is not a complete defence.
• Keep tool permissions narrow and validate consequential actions outside the model.
• Test adversarial documents as well as ordinary user questions.

Practical example: A document-reading assistant encounters text telling it to email confidential files. The application must not grant that instruction authority.

One action today: Review what your assistant could access or change after reading a malicious document.