Prompt injection
In one sentence
Prompt injection is when text supplied to a model contains instructions that override or subvert its intended behavior, and it is the defining security problem of language model applications.
Not to be confused with System prompt.
Definition
Prompt injection is hiding instructions inside text the AI reads, so it follows them instead of yours.
The vulnerability is structural, not a bug. A model processes instructions and data through the same channel, so text that looks like an instruction can be treated as one regardless of where it came from.
The two forms
- Direct injection: the user supplies the malicious instruction, attempting to override the system prompt.
- Indirect injection: the malicious instruction arrives inside content the system retrieves or ingests, and the user may be entirely innocent.
- Indirect is the more serious and more overlooked, particularly in retrieval-based systems.
Why retrieval creates the exposure
- A RAG system treats retrieved passages as trusted context.
- If a business uploads documents from multiple contributors, or ingests content it does not fully control, instruction-like text can enter the context.
- The model has no reliable way to distinguish a passage about a returns policy from a line that says to ignore previous instructions.
- This is a genuine and under-appreciated risk in any system that ingests documents.
Voice-specific characteristics
- Spoken direct injection is clumsier than typed. Reciting an elaborate override aloud is awkward and conspicuous.
- But transcription adds a wrinkle: the recognizer may produce text that resembles an instruction from audio that did not clearly contain one.
- Indirect injection through uploaded documents is fully applicable and is the more realistic vector for a business voice agent.
Mitigations, none of which fully solve it
- Treat all retrieved and user-supplied content as untrusted.
- Structural separation, marking data clearly as data in the prompt construction.
- Output screening, which catches consequences rather than causes and is more reliable than input filtering.
- Action guardrails, constraining what tools can be called and with what arguments, regardless of what the model was persuaded to attempt.
- Least privilege, so a compromised agent can do limited damage.
- Input filtering for known patterns, which is easily evaded and worth doing anyway.
The honest position
- Prompt injection is not solved. Defences reduce risk and none eliminates it.
- The practical security posture is to limit what a compromised agent could do, rather than to assume it cannot be compromised.
Common misconception
That prompt injection is fixed by better instructions in the system prompt. Instructions are exactly what the attack targets, so the defense has to come from outside the model.
Why it matters commercially
For a voice agent with tool access, a successful injection could produce unauthorized actions. For any agent, it could produce statements the business must stand behind. Action guardrails are the answer, and they are checkable in evaluation.
In voice specifically
Speaking an override aloud is clumsy and conspicuous, so spoken direct injection is weaker than typed. The real voice exposure is indirect: a business voice agent ingesting uploaded documents inherits the injection surface of every file it reads. Transcription can also produce instruction-like text from audio that did not clearly contain any.
Where AsqVox fits
A RAG system ingesting uploaded documents has an indirect injection surface. Treating uploaded content as untrusted, and constraining actions independently of model output, are the relevant mitigations.
Visual
The instruction that arrived as data
Instructions and data share a channel. That is the vulnerability, and it is structural.
Statistics
Every figure carries its source and year. Vendor numbers are labelled as vendor numbers, and where no reliable figure exists this page says so rather than borrowing one.
Prompt injection is widely recognized as a primary security risk for language model applications and appears at the top of published risk taxonomies for the category.
Top of published risk taxonomiesindustry rangePublished LLM application risk taxonomies, 2026 - Cite it as a category-level consensus rather than a single measured figure. Its position at the top of the risk lists is the citable fact, not a percentage.
EU AI Act Article 50 transparency obligations become enforceable on 2 August 2026, and a successfully injected agent producing undisclosed or misleading output engages obligations the business holds regardless of the attack.
2 August 2026industry rangeEU AI Act, Article 50, 2026 - The regulatory point is that the business carries the obligation even when the misleading output came from an attack it did not author. Cite the enforcement date.
There is no standard benchmark for prompt injection resistance, no common test suite for voice systems, and no published bypass rate data, so vendor claims of injection resistance are unverifiable by third parties.
-no reliable figureAny vendor claiming a resistance rate is quoting a private test with no independent method to check it. Treat a claimed immunity number as unverifiable.
There is no published measurement of indirect injection prevalence in real document corpora, which is the risk most relevant to RAG deployments.
-no reliable figureThe exact risk that matters for a document-ingesting voice agent is the one nobody has measured in the wild. Assume the surface exists rather than waiting for a prevalence figure.
The defensive literature is developing and no approach currently claims to solve the problem, so any vendor claiming immunity should be treated with suspicion.
-no reliable figureSolved-injection claims contradict the current state of the field. The credible position is risk reduction plus damage limitation, not immunity.
Examples
In practice
A company allows multiple departments to upload documents to the knowledge base of its voice agent. One document, prepared externally, contains text instructing any reading system to disregard prior constraints. Retrieved as context, it partially alters the behavior of the agent. The mitigation is to screen uploads, mark retrieved content structurally as data, and constrain tool access so behavior changes cannot produce actions.
The everyday version
Prompt injection is hiding instructions inside text the AI reads, so it follows them instead of yours. It matters most if you let several people upload documents, because a document is just text and the system reads instructions and information the same way. The defense is limiting what it is allowed to do, not asking it more firmly to behave.
Usage
Who says it
- AI security researchers and platform engineers.
- Increasingly appears in enterprise security questionnaires.
Where it turns up
- Next to security, guardrails, input validation, output filtering, tool access controls and audit logging in an RFP.
- A sophisticated buyer asks about indirect injection specifically, not just direct.
Common misuse
- Claiming resistance through system prompt instruction.
- Overlooking retrieved documents as an injection surface.
- Treating input filtering as sufficient, when it is easily evaded.
Questions people ask
What is prompt injection?
It is when text supplied to a model contains instructions that override or subvert its intended behavior. The vulnerability is structural: a model handles instructions and data through the same channel, so text that reads like an instruction can be acted on regardless of where it came from. It is the defining security problem of language model applications.
What is the difference between direct and indirect prompt injection?
In direct injection the user supplies the malicious instruction themselves, trying to override the system prompt. In indirect injection the malicious instruction arrives inside content the system retrieves or ingests, such as an uploaded document, and the user may be entirely innocent. Indirect is more serious and more overlooked, especially in retrieval-based systems.
Can a better system prompt stop prompt injection?
No. Instructions are exactly what the attack targets, so adding more of them does not defend against it. The defense has to come from outside the model: treating retrieved content as untrusted, separating data from instruction, screening the output, and constraining what tools can be called regardless of what the model was persuaded to do.
Is prompt injection a solved problem?
No, and any vendor claiming immunity should be treated with suspicion. There is no standard resistance benchmark, no common voice test suite, and no published bypass-rate data, so resistance claims are unverifiable by third parties. Defences reduce risk; none eliminates it. The practical posture is to limit what a compromised agent could do.
Last reviewed 3 August 2026. Written and reviewed by Dhruv Dholakia, founder of AsqVox.