Prompt Injection

General definition

Prompt injection exploits the fact that language models cannot reliably distinguish between trusted instructions from the developer and untrusted text from users, documents, or tool results. An attacker who can influence the model’s input can attempt to override safety guidelines, extract confidential system prompt content, or cause the model to take unintended actions.

Two main variants exist. Direct injection occurs when the user sends a message designed to subvert the system prompt, for example “Ignore all previous instructions and...”. Indirect injection occurs when malicious instructions are embedded in content the model retrieves or processes, such as a web page fetched by a tool or a document uploaded by the user.

• Indirect injection is particularly dangerous in agentic systems where the model browses the web, reads files, or calls external APIs
• Privilege separation, where less-trusted content is processed with reduced permissions, limits the blast radius
• Input and output filtering, allow-listing permitted actions, and human-in-the-loop confirmation for sensitive operations all reduce risk
• No single defence eliminates the attack surface; defence-in-depth is the standard approach

In the Ethora ecosystem

When building self-hosted LLM agents with the Ethora AI SDK, the agent operates inside your infrastructure, which means you control the full execution environment including input sanitisation, the tools the agent can call, and whether any action requires a confirmation step before execution.

For healthcare and finance deployments, limiting the agent’s permitted actions to a defined allow-list and logging every tool call through an audit log are practical steps that reduce the impact of a successful injection attempt and satisfy compliance requirements for traceability.