# Prompt Injection

> Prompt injection is an attack in which text supplied to an AI system, either typed by a user or hidden in content the system reads such as an email, web page or document, contains instructions that override the system's intended behavior. Because language models cannot reliably tell instructions apart from data, injected text can make an assistant leak information or misuse its tools.

## Why it matters for your business

Any AI system that reads outside content and can take actions is exposed. An inbox assistant that reads customer emails and can forward messages could be told, by a malicious email, to forward sensitive data elsewhere. There is no complete fix inside the model, so defenses are architectural: limit each agent's tools and permissions, require approval for sensitive actions, separate untrusted content from instructions, filter outputs and log tool calls. OWASP ranks prompt injection first in its 2025 Top 10 for LLM Applications, which reflects how seriously the security community treats it.

## Example

A recruiting team uses an AI assistant to summarize incoming resumes. One applicant hides white text in a PDF telling the AI to rate them as the top candidate. Because the assistant only writes summaries, has no ability to change a candidate's status, and a recruiter reviews every shortlist, the hidden instruction cannot move the candidate forward on its own.

Related terms: https://www.lumeor.studio/glossary/guardrails/, https://www.lumeor.studio/glossary/tool-calling/, https://www.lumeor.studio/glossary/system-prompt/, https://www.lumeor.studio/glossary/human-in-the-loop/, https://www.lumeor.studio/glossary/ai-governance/

---

Source: https://www.lumeor.studio/glossary/prompt-injection/