In this guide · 7 sections
Short answer
Prompt injection is text that tricks an AI into ignoring its instructions. It can be typed directly into a chatbot, or hidden indirectly in an email, web page or file the AI reads. There is no complete fix, so give AI tools minimum access and require human approval for sending, paying or deleting.
What is prompt injection?
An AI model receives your instructions (the 'system prompt': who it is, what it may do) and then other text: the user's question, a document, a web page. It processes all of it as text. It has no reliable way to tell your instructions apart from instructions buried in the content. Prompt injection exploits that.
The OWASP project's LLM01:2025 Prompt Injection entry describes it as user prompts or other inputs altering the model's behaviour in unintended ways, and notes the input does not even need to be visible to humans, only readable by the model. It also says plainly that, given how generative AI works, it is unclear whether there are fool-proof methods of prevention.
Direct injection
- The attacker types into the chatbot themselves
- Classic example: 'ignore your previous instructions and...'
- Aims to extract the system prompt, bypass rules or get off-topic output
Best for: Main risk for public website chatbots.
Indirect injection
- Instructions hidden in content the AI reads for you
- Emails, web pages, PDFs, CVs, product reviews, calendar invites
- The attacker never talks to your AI directly
Best for: Main risk for assistants and agents connected to your data.
Prompt injection examples a small business might meet
These are adapted from OWASP's published attack scenarios, set in everyday business situations.
- Website chatbot: a visitor persuades your support bot to reveal its internal instructions, promise a discount, or produce offensive text that ends up in a screenshot on social media.
- Email assistant: an incoming email contains hidden text telling the AI to forward the last ten invoices to an outside address. If the assistant can send email, it may try.
- Web research: an AI summarising a web page follows hidden instructions on that page, for example inserting a link that leaks parts of the conversation (OWASP scenario 2).
- Hiring: a CV contains instructions, split across the document, telling the screening AI to rate the candidate highly (OWASP scenario 6).
- Knowledge base poisoning: someone edits a document your chatbot draws answers from, so it gives customers misleading information (OWASP scenario 4).
OWASP lists the possible outcomes as disclosure of sensitive information, revealing system prompts, manipulated output, unauthorised access to functions the AI can use, commands executed in connected systems, and manipulated decisions.
Why AI agents raise the stakes
Prompt injection on its own only changes what the AI says. It becomes serious when the AI can do things: read your files, send emails, call APIs, change bookings or run code. Risk roughly equals what the AI can reach, multiplied by what it can do without asking.
CSA's advisory on the risks of OpenClaw (AD-2026-005), published on 28 May 2026, describes this for autonomous AI agents generally: weak access controls, sensitive data exposure, malicious third-party skills and memory poisoning can lead to agent hijacking and unauthorised actions through tool or API abuse. Its recommendations for organisations include least privilege, multiple narrowly scoped agents instead of one all-purpose agent, logging every action, and requiring human approval for high-stakes or irreversible actions, enforced through system-level controls such as approval workflows and permission gates, not just prompt-layer instructions.
How to reduce prompt injection risk in practice
OWASP lists seven mitigations, and CSA's Guidelines and Companion Guide on Securing AI Systems cover the wider lifecycle. For a small deployment, they come down to these steps.
Give the AI only what it needs
A website chatbot should see your public FAQ and pages, not your CRM. An assistant that drafts replies does not need permission to send them.
Put approval gates on actions
Sending emails, issuing refunds, changing bookings, deleting files and payments go through a human approval step built into the tool, not the prompt.
Separate trusted and untrusted content
Label external content (emails, web pages, uploads) as untrusted, and do not let it trigger tools on its own.
Constrain and check outputs
Limit answers to your topics, validate structured outputs in code, and block links or images to unknown domains in chatbot replies.
Use separate credentials and log everything
Give each AI tool its own account and keys, rotate them, and keep logs of what it read and did.
Test it like an attacker
Before launch, try to make it reveal its instructions, go off-topic or take an action. Repeat after each change.
Website chatbot or AI agent: how worried should you be?
Match your effort to what the AI can reach.
| Set-up | Main injection risk | Minimum protection |
|---|---|---|
| Q&A chatbot on public content, no tools | Embarrassing or off-topic answers, leaked prompt | Topic limits, no secrets in the prompt, log review |
| Chatbot that captures leads | Junk or abusive submissions | Validate fields, rate limits, human follow-up |
| Assistant reading your inbox or files | Data leakage through hidden instructions | Read-only access, no auto-send, approval for any outbound action |
| Agent with tools (email, bookings, payments) | Unauthorised actions | Narrow scope, approval gates, separate credentials, full logging |
Our AI agents cost guide covers what agents are worth for a small business, and our AI hallucinations guide covers the related problem of AI simply getting facts wrong.
Do it yourself or get help?
You can lower most of the risk yourself by checking what each AI tool is connected to and removing anything it does not need, especially send, delete and payment permissions. Ask any vendor selling you an AI agent how approvals and logging work, and whether its safety relies only on prompt wording.
Prompt injection quick audit
IT Sorted's AI Website Assistant (S$790) answers only from your own content, with guardrails, lead capture and hand-over to WhatsApp or email, and no access to your internal systems. A Security Health Check (S$290) reviews your domain, website, email and workspace settings, including admin roles and connected apps. See also our AI chatbot guide.
Frequently asked questions
It is a way of tricking an AI tool into ignoring its instructions by feeding it text containing different instructions. The text can be typed into a chatbot directly, or hidden in content the AI reads, such as an email, web page or document. The AI cannot reliably tell your instructions from the attacker's.
Direct injection is when the attacker types instructions into the AI themselves, for example into a website chatbot. Indirect injection is when instructions are hidden in content the AI processes on your behalf, such as an email it summarises or a web page it reads, so the attacker never interacts with your AI directly.
Not with current technology. OWASP states it is unclear whether fool-proof prevention exists because of how generative AI works. The practical approach is to limit impact: give AI tools minimal access, require human approval for important actions, separate untrusted content and log what the AI does.
Yes, but the impact is usually limited if the chatbot has no tools and only reads public content. The main risks are off-topic or embarrassing answers and leaking its instructions. Keep secrets out of the prompt, limit topics, review logs and never connect it to systems that can take actions without approval.
In its May 2026 advisory on OpenClaw, CSA recommends least privilege, narrowly scoped agents, dedicated and rotated credentials, logging all agent actions, and human approval for high-stakes or irreversible actions such as payments or sending external communications, enforced through system-level controls rather than prompt instructions.