Prompt Injection in Depth

Direct — the attacker is the user. Impact is usually limited to their own session.

Indirect — the attacker plants content the model later ingests: a web page, a PDF, a ticket, a calendar invite. When a different user's assistant reads it, instructions fire in the victim's context with the victim's privileges. Serious for the same reason stored XSS beats reflected.

Why filtering fails: natural language is infinitely paraphrasable — other languages, encodings, homoglyphs, split across turns, framed as fiction, hidden in white-on-white text or metadata. You cannot enumerate the badness. Same lesson as XSS blocklists, learned again.

Defences that actually hold, in order of worth:

1. Least privilege on tools — narrowest possible capability, no ambient credentials.

2. Human in the loop for irreversible actions, with real parameters shown.

3. Treat output as untrusted at every sink.

4. Isolate untrusted content; prefer structured extraction.

5. Egress controls — stop exfiltration even after a successful injection.

Not on the list: "write a stronger system prompt." That's defence-in-depth, never the control you rely on.

Severity = privilege of the attached tools. A model with no tools that says something rude is a content problem. The same injection against a model holding send_email is a breach.