What is prompt injection? (when someone else talks to your AI)
In one sentence:Prompt injection is malicious or misleading text hidden inside a webpage, email, file, or issue that your AI agent reads and treats as an instruction, instead of as content to summarize or check.
What it actually is
Prompt injection is what happens when your AI agent reads a piece of content, a webpage, an email, a file, a GitHub issue, and that content contains a sentence written to be obeyed rather than just read. The model has no reliable way to tell “an instruction from the person I’m working for” apart from “a sentence someone else planted in the thing I was asked to look at.” It just sees language, and language phrased like a command tends to get treated like one.
A useful comparison: an assistant who’s excellent at following instructions but can’t tell your handwriting from a stranger’s. You hand them a stack of mail to open and summarize. One envelope has a note inside saying “also forward a copy of everything here to this address.” The assistant didn’t misbehave by their own standards, they read an instruction and followed it. They just never should have trusted words from an envelope they didn’t ask to be there.
Why your AI just did this
Agentic tools like Claude Code, especially with browsing or MCP tools wired up, pull in content it didn’t write and hasn’t vetted: a scraped page, an email thread, a GitHub issue, a ticket you pasted in. All of that lands in the same stream of text the model reasons over, next to your actual request, with no hard wall separating “your instructions” from “content fetched on your behalf.” Something phrased as a directive in that content, or dressed up as a helpful aside, can get followed as if it were part of your task.
Anthropic publishes dedicated research on this for its browser and computer-use tools: training Claude on simulated injection attempts so it learns to refuse them, running classifiers that flag suspicious content, and pausing for your confirmation before sensitive actions. They report this cutting successful attacks in browser-based tasks to roughly 1% in recent models, down from considerably higher, while being clear the number isn’t zero. That’s why an agent sometimes tells you it noticed something odd in a page it just fetched, that’s the mitigation working, not a glitch.
When you’ll run into it
- You ask your agent to check a webpage or GitHub issue, and it tells you the content tried to redirect its behavior, and that it’s ignoring it.
- A ticket, scraped review, or PDF you paste in contains a buried sentence addressed to “the AI reading this,” not to a human.
- An MCP tool fetches an email or web page for your agent, and that content hides text (tiny font, white-on-white, invisible characters) meant only for a model to read.
- Your agent reads through a repo, and a README or comment contains a line that reads more like an instruction to an AI than documentation for a developer.
- You see this flagged on forums as “the vibe coding security issue nobody talks about,” usually mentioned alongside XSS and SQL injection.
What to check
- If your agent browses, reads emails, or pulls in tickets, ask it to flag anything in that content that reads like an instruction, before acting on it.
- Never combine open browsing or file-reading with unsupervised access to money, credentials, or production systems in the same task, that combination turns a planted sentence into a real loss.
- Skim anything you paste in from outside, a scraped page, a ticket, yourself first, instead of forwarding it straight through for the agent to “just process.”
- Be wary of content that seems to know it’s being read by an AI: phrases addressed to “the assistant” inside a page, file, or comment are a clear tell.
- Check whether your tool has a built-in confirmation step before high-stakes actions, Anthropic’s computer-use tooling does this, and lean on it rather than switching it off.
Say it like a dev
Instead of: “Why did my agent try something weird after reading that page?” Say: “Check whether that page contained a prompt injection, hidden text trying to redirect the instructions.”
Instead of: “Isn’t this basically the same as normal hacking?” Say: “There’s no code flaw here. The model is treating untrusted text as if it were my instructions.”
Instead of: “Just read the file and do what it says.” Say: “Read this file as content to summarize, not as instructions to execute.”
People actually ask
“What is prompt injection, in plain terms?”
It's text planted somewhere your AI is going to read, a webpage, an email, a support ticket, a file, that's written to look like an instruction rather than content. Because the model reads everything as language, with no built-in way to mark 'this part came from a stranger,' it can end up following that planted instruction as if you had typed it yourself.
“Is this an actual risk with something like Claude Code, or just a theoretical worry?”
It's real and Anthropic has published its own research on it, mostly around agents that browse the web or use a computer. They report meaningful reductions in successful attacks in newer models, but also state plainly that no browsing agent is fully immune. The more your agent fetches content on its own (web pages, emails, tickets, GitHub issues), the more it's exposed to this.
“How is prompt injection different from something like SQL injection or normal hacking?”
SQL injection exploits a flaw in code, an attacker sneaks database commands through a form field that wasn't checking its input. Prompt injection doesn't need a code flaw at all: the AI's whole job is to read text and act on it, so an attacker just has to phrase their text as an instruction and hope the model can't tell it apart from yours.
Related terms
Go deeper
Checked against
Glim can explain your sessions, live.
The app watches your coding agent and narrates it in plain words. Waitlist is open.