Prompt injection

When the input contains instructions.

The problem

A model reading a document, web page or email will treat instructions inside it as text worth following. It cannot reliably distinguish data from commands.

Never let untrusted content trigger actions without a human check.
Say explicitly that content between markers is data to analyse, not instructions.

Defence in depth

Limit what tools a model can reach, validate outputs before acting on them, and log everything. There is no prompt that makes injection impossible.