PROMPT INJECTION AND TOOL POISONING

CHAPTER SUMMARY Prompt injection exploits the fact that models read instructions and data as one stream of text. Direct injection comes from the user; indirect injection hides in fetched content; tool poisoning hides in tool descriptions. Data exfiltration is the usual goal, and the combination of private data, untrusted content, and outward communication is especially dangerous. Because no technique fully eliminates injection, harnesses must treat external content as untrusted data, limit capabilities, restrict outbound channels, validate in code, require approvals, log tool calls, and assume some attacks will succeed. KEY TERMS REVIEW Prompt injection: hidden instructions that hijack an agent. Direct injection: malicious instructions typed by the user. Indirect injection: malicious instructions hidden in fetched content. Instruction hierarchy: ranking system rules above user text. Tool poisoning: malicious instructions hidden in tool descriptions. Rug pull: a tool that changes behavior after being approved. Data exfiltration: secret theft of private data. Conversation hijacking: steering the agent away from the user's intent. Covert tool invocation: causing hidden tool calls. Untrusted by default: treating external content as data and never as commands.