Section 101 · Chapter 13, AI Security and Guardrails
Prompt Injection and Indirect Prompt Injection
Prompt injection is what happens when untrusted text tries to become instructions.
prompt injectionindirect prompt injectionuntrusted contexttool injectiontrust boundary
What to do
- Test nonprinting Unicode characters, zero-width joiners, bidirectional text controls, hidden HTML or CSS, OCR artifacts, base64-like payloads, QR codes, barcode text, image alt text, metadata fields, and even encoded instructions such as Morse code.
- Do not rely on prompt wording alone.
- Define runnable checks that exercise prompt injection, indirect prompt injection, and untrusted context.
Evidence to preserve
- Preserve the inputs, versions, configurations, raw outcomes, and results for prompt injection, indirect prompt injection, untrusted context, tool injection needed to reproduce work on Prompt Injection and Indirect Prompt Injection.
- Report results for prompt injection, indirect prompt injection, untrusted context, tool injection by relevant slice, separate blocker failures from averages, state uncertainty and blind spots, and connect the result to a release decision.
Expert note
In a real release review, test instruction hierarchy, prompt parameterization, section-header boundaries, content isolation, tool permission checks, output filtering, human approval, least privilege, taint tracking, source trust, and audit logs. A good defense assumes the model will sometimes be confused and limits what confusion can do.
Continue the conversation
Apply this to your context.
Save your product context once, then open a focused conversation that combines it with this concept.
Cite this page
Jason Arbon. "Prompt Injection and Indirect Prompt Injection." Testing AI Knowledge Edition, section 101.
https://jarbon.ai/testing-ai/knowledge/ch101-prompt-injection-indirect-prompt-injection.html