HD Field Guide 04
Prompt injection: treat content as untrusted
Protect AI applications that read webpages, files, email, retrieved records or user-controlled instructions.
Prompt injection occurs when instructions embedded in user or external content alter intended model behaviour. It cannot be solved by a single warning in the system prompt.
Assume retrieved content may be hostile
A webpage, PDF, email, code repository or knowledge-base entry can contain instructions intended for the model rather than the human reader. The content may attempt to reveal data, redirect a workflow or trigger a tool.
Sanitisation helps but is not a complete defence because malicious instructions can be expressed in many forms.
Keep security decisions outside the model
Use deterministic application controls for authentication, authorisation, input validation, data access and transaction limits. The model can propose an action, but code should decide whether the action is permitted.
Use allowlists for tools and parameters, narrow retrieval scopes and structured outputs that are validated before use.
Monitor the complete chain
Record the source content, model decision, tool request, policy decision and outcome. Monitoring only the final response can miss manipulation that occurs inside orchestration.
Create abuse tests and incident playbooks for data exposure, unauthorised tool use and unexpected cross-user access.
Before you close the guide
- Untrusted content clearly isolated
- External policy enforcement for every tool call
- Structured output validated before execution
- Injection and cross-user tests included
Continue with primary guidance
This guide provides general educational information. Adapt it to your organisation’s policies, contracts, legal obligations and incident process. For an active incident, use trusted professional and official support channels.