Prompt Injection
Prompt injection is an attack in which adversarial input manipulates an AI agent into performing unintended actions. The attacker embeds instructions in data the agent processes (a document, email, web page, or tool response) that override or subvert the agent's original instructions.
Why It Matters
Prompt injection is the defining security threat for AI agents. Unlike traditional injection attacks (SQL injection, XSS), prompt injection exploits the fundamental mechanism by which language models process input: they cannot reliably distinguish between instructions and data.
For agents with tool access, prompt injection is not a theoretical concern. An agent that reads an email containing hidden instructions could be manipulated into forwarding sensitive data, creating unauthorized accounts, or executing destructive operations. The agent follows the injected instructions because it processes them as if they were part of its task.
Credential mediation is the structural mitigation: if the agent never holds real tokens, a successful prompt injection cannot exfiltrate credentials. Per-action policy enforcement is the behavioral mitigation: even a manipulated agent cannot execute actions that policy denies.