Treat external content as information to examine, not authority to obey.
When data pretends to be instructions
An assistant might read a webpage to summarize it. Text on that page could instead tell the assistant to ignore its task or reveal information. The issue is that untrusted material can try to influence how the system behaves.
Why a content filter is not enough
A malicious instruction does not have to contain violent or otherwise objectionable language. “Send this document to a different address” can be perfectly ordinary text with a harmful purpose in context.
Several boundaries work together
Applications can limit tool permissions, separate trusted instructions from external content, inspect proposed actions, and ask for approval before sensitive operations. A detector can contribute evidence, but it should not be the only boundary protecting a powerful tool.
The attacker may never speak to you
OWASP describes indirect injection through content such as web pages, documents and emails. A user can ask an entirely legitimate question while the assistant encounters a hostile instruction in material it reads. The trust question is therefore who supplied each piece of text, not merely whether the user’s initial request looked safe.
Source: OWASP · LLM Prompt Injection Prevention Cheat SheetMeasure what an attack can achieve
A demonstration that changes an answer is different from one that sends private information to an outside recipient. Our recommendation is to define an unwanted outcome before testing. Include the tools, data and permissions available in the test report; otherwise a success rate says little about the possible consequences in another application.
Detection is one layer
An attack classifier may recognize suspicious text, but long inputs, new strategies and benign quoted examples complicate detection. Prompt Guard’s card explicitly discusses scope and adaptive attacks. For an application, combine screening with boundaries on what information can be retrieved and which actions can execute.
Source: Meta · Llama Prompt Guard 2 model cardA situation to think through
A vendor PDF asks an invoice assistant to send a copy of all invoices to a new address. The PDF is evidence for extracting the vendor’s bill, not authority to expand the task. A system with no external-mail permission contains that possible failure even if its model follows the text.
Questions to take with you
- Identify every place third-party content enters the workflow.
- Test for concrete outcomes such as disclosure or unauthorized changes.
- Keep legitimate quotation and security analysis usable when detectors flag suspicious text.
For more reading
The sources behind this page, with a reason to open each one. Practical examples and recommendations are our editorial interpretation.
- LLM Prompt Injection Prevention Cheat Sheet
Threat examples and layered defenses for applications that process untrusted text.
- Llama Prompt Guard 2 model card
Explains binary attack detection, the 512-token window and differences between the 22M and 86M versions.
- AI Agent Security Cheat Sheet
Practical guidance on tool permissions, memory isolation, oversight and agent failure handling.
Sources reviewed 13 September 2026. Product documentation can change. How we use evidence