Prompt Injection
An LLM reads instructions and data as the same thing: text. So text inside an email, a web page or a tool result can pretend to be an instruction. The model may obey it. This is prompt injection. There is no complete fix. But layered defences can make it rare and, more importantly, harmless.
New words
- Prompt injection
- Hidden text that tricks the model into following the attacker.
- Indirect injection
- The attack hides in content the model reads, not in the chat.
- Exfiltration
- Sneaking private data out of a system.
- Least privilege
- Give the agent only the tools and access it needs.
- Delimiter
- A marker that shows where untrusted text starts and ends.
- Red-teaming
- Attacking your own system on purpose to find weak points.
What you will learn
- The problem: data that gives orders
- Direct and indirect injection
- How an attack flows through an agent
- Try it: defend the email assistant
- Why there is no complete fix
- Layered defences in production
- In code
- In a real system
- Interview tip
- Key takeaways
10 quiz questions at the end.
The full lesson, with interactive demos and the quiz, opens after you sign in with Google. It is free.