Why this matters
- PolicyDesk fetches handbook pages and, in the agent design, intranet articles. Those pages are data. If the model obeys instructions written inside them, anyone who can edit a page can steer the assistant.
- The attacker does not need a chat box. They need a document you will retrieve.
- This is the security question that follows "we added tools and web retrieval." Tools turn a bad sentence into an action.
- You can explain the risk and the defenses without rehearsing exploit strings. The defenses are the interview answer.
What it is
Direct prompt injection is a user typing an instruction meant to override the system prompt. Indirect prompt injection places that kind of instruction in content the system fetches later: HTML, a PDF, a comment, an email, a wiki page, an image alt text, or a database field. The model reads it as part of the context and may follow it: ignore the system rules, reveal a secret that was also in context, or call a tool with arguments the user never asked for.
The person who benefits does not have to be the person in the chat. They only have to get a string into a source you index or browse.
Why it works
- The model sees one token stream. A sentence in a document and a sentence in the system prompt are both tokens, and the model was trained to follow instructions wherever they appear.
- Retrieved text looks like ordinary policy language, so a naive pipeline concatenates it under a label and hopes.
- Tool access raises the impact from "a weird answer" to "an API call, a data export, or a write."
- RAG and agents increase exposure because they are designed to read untrusted or semi-trusted corpora and to act.
You do not need a jailbreak anthology to design against this. Assume that any byte you did not write — including PDFs from your own intranet — may contain an instruction addressed to the model. Build as if that instruction will sometimes be persuasive.
The rest of this guide is part of Pro
Free covers every fresher guide in full. Pro unlocks Senior, Staff and Architect guides across every track.
Still to come · 2 sections
- Defenses that belong in the architecture
- Practices around the pipeline
Test yourself
Answer these before moving on — recall is what makes it stick.