Prompt injection, direct and indirect

Two routes in

Direct injection comes from the person talking to the model: their message competes with the developer's instructions. Indirect injection comes from content the model processes on someone's behalf: an email, a web page, a shared document, a tool description, a pull request.

Indirect injection is the more dangerous one, because the victim never sees it. The attacker doesn't need access to the application, only a way to put text where it will be read.

Why it's hard to fix

The model can't reliably tell instructions from data, because both are just text. Every prompt-level defence (rules, delimiters, filters, a second model as judge) lowers the odds of an attack working. None of them makes it impossible.

That's why OWASP ranks prompt injection first, and why the lasting fixes are about what a successful injection can achieve, not about stopping every one.

What holds

Assume injection will sometimes succeed, and limit the damage: no secrets in context, least-privilege tools, confirmations the system draws for consequential actions, and checks on output before it's rendered or acted on.