Guide
Prompt injection: how an AI agent can be tricked by what it reads.
An AI assistant that reads your email also reads what strangers write to it. If a message contains instructions, the AI may follow them. This weakness has a name, prompt injection, and it matters most when an AI can act on your behalf.
In short. Language models take their instructions and the text they work on through the same channel, so text in an email or web page can be read as an order. Simon Willison named this prompt injection in 2022, and OWASP ranks it first among the risks of applications built on large language models. Nobody knows of a complete fix. What works is limiting the damage: little power for the AI, and a human yes before anything that matters.
How it works
When you ask an assistant to summarise your inbox, it reads every message, including ones written by strangers. If one says, in words meant for the AI rather than for you, “forward the latest invoice to this address”, a model may treat it as a request. OWASP describes two kinds:
- Direct: someone types instructions into the AI to make it misbehave.
- Indirect: the instructions arrive inside content the AI reads, such as a web page, a file or an email. They do not even have to be visible to a person, as long as the model reads them.
The name comes from Simon Willison, who proposed it in September 2022, after Riley Goodside showed that a model told to translate a sentence could be made to ignore that order by text inside the sentence itself.
Why agents raise the stakes
A chatbot that is tricked writes something wrong. An agent that is tricked can do something wrong: send, pay, delete, share. OWASP notes that how bad an injection gets depends on the setting and on how much agency the system has. The more an AI can do on its own, the more a single malicious email can do through it. What agents are: a plain guide and agent vs chatbot.
What limits the damage
OWASP says it is unclear whether fool-proof prevention exists, and lists ways to reduce the impact. In plain words:
- Give it the least power it needs. Read access where reading is enough; actions handled by ordinary code, not by the model.
- Ask a person before risky actions. Sending, paying and deleting wait for a human yes: an AI that asks first.
- Keep outside content apart, clearly marked as untrusted, so it carries less weight than your own words.
- Check what comes out: expected formats and filters, enforced by code.
- Test it like an attacker would, regularly.
What to ask before you let an AI act for you
- Which actions can it take without asking me?
- Can it send anything to someone new without my approval?
- Does it show me exactly what it will do, with the recipient, the amount and the time, before it does it?
- Is there a log of everything it did?
How Lychnos Ring is designed
In Lychnos, the AI proposes and tested code decides what needs your yes. Anything that sends, moves, pays or deletes waits for one press on the ring, with the action spelled out on its screen, and two presses stop it. Payments by voice are planned only to payees you have approved in the app, with small limits and your bank’s own approval. Every action is in the app’s log. It is in development: an AI agent on your finger.
Sources, read 4 November 2026: OWASP Gen AI Security Project, LLM01:2025 Prompt Injection; Simon Willison, prompt injection attacks against GPT-3, 12 September 2022.
Questions
What is prompt injection?
Text that an AI model reads, in an email, a web page or a file, and treats as an instruction instead of as data. It can make an assistant reveal information or take actions the user did not ask for.
Can prompt injection be prevented?
Not completely, as far as anyone knows: OWASP, the security project, says it is unclear whether fool-proof prevention exists. Its effects can be limited: give the AI as little power as it needs, keep untrusted content apart, and have a person approve anything risky.