What is Prompt Injection?
SecurityAn attack that smuggles instructions into the agent's context: through retrieved documents, tool outputs, or user input. The agent reads the injection as direction and acts on it: OWASP's top agentic risk.
Why It Matters
Prompt injection is the attack that turns the agent’s own loop against it: instructions smuggled into context get read as direction, and the agent acts on them with whatever authority it holds. The documented incidents show what “acts on them” means. Amazon Q was hit by an injection in the official AWS VS Code extension instructing it to delete filesystems and wipe S3 buckets; only a syntax error in the payload stopped mass destruction across a million-plus installs. An injection on Cline’s triage bot stole npm tokens and shipped a malicious package to roughly 4,000 developers in eight hours. A single injection class across three major agent products made them leak their own API keys, rated CVSS 9.4.
Where the Injection Enters
Retrieved documents. Content the agent reads for a task carries instructions aimed at the agent, not the user.
Tool outputs. A tool’s response embeds directives, and the model treats the tool’s output as trusted context.
User input. The direct channel: crafted requests that override or sidestep the standing instructions.
The indirect channels are the dangerous ones, because nothing in the visible conversation reveals that the agent is reading hostile instructions from a document it fetched on the user’s behalf.
Where Defenses Break
Instruction hardening is the defense that looks like a defense: better wording in the system prompt reduces the attack surface as a probability, not as a boundary, because the injected instruction reaches the same model the real instructions do. What works is enforcement outside the model’s reasoning: the tool call the injection produces still has to pass the pre-action gate, and a deny there ends the attack regardless of how convincing the injection was.
How Flytebit Handles It
We treat injection as a governance problem: the model will read hostile instructions, so the control is that hostile instructions cannot produce unauthorized actions. Enforcement at the tool boundary, scoped credentials that limit what a compromised context can reach, and decision records that make the injected action auditable. The incident catalog is in Agentic AI Horror Stories, and the control layer is our AI governance and risk work.