Quick answer
Prompt injection is an attack that hides malicious instructions inside content an AI model reads — a webpage, an email, a document — so the model follows the hidden instructions instead of, or alongside, its user's actual request. It matters more in 2026 than it used to because AI agents now browse the web and read your inbox on your behalf, giving attackers a much bigger surface to plant hidden commands. There is no complete fix, only mitigations: sandboxing, permission limits, and treating any content an agent reads as untrusted by default.
A chatbot that only answers questions you type is fairly safe from this. An AI agent that reads your email, browses a webpage, or opens a PDF on your behalf is a different story — because now the AI is reading content it did not choose, and it cannot always tell the difference between "instructions from my user" and "text that happens to contain instructions."
How the attack actually works
Direct prompt injection is the simple version: you type an instruction straight into a chat window trying to override the model's rules — "ignore your previous instructions and do X instead." Most production AI products have gotten reasonably good at resisting this.
Indirect prompt injection is the dangerous version. An attacker plants hidden text somewhere an AI agent will encounter it later — inside a webpage's HTML in white-on-white text, inside an email's body, inside a PDF's metadata, even inside an image's alt text. When your AI agent later reads that page or email while doing a task for you, it can pick up the hidden instruction as if you had typed it yourself.
- A webpage with hidden text telling any AI that reads it to leak the user's browsing history
- An email with an invisible instruction telling an AI assistant to forward itself to an external address
- A shared document with a comment telling a coding agent to also modify an unrelated file
- A calendar invite description containing a hidden command aimed at an AI scheduling assistant
Why agents made this so much worse
Through 2024 and 2025, AI moved from "answers your question" to "does things for you" — browsing, reading email, using tools, running code. Every one of those capabilities is also a new place an attacker can hide an instruction. A model reading a hostile webpage is exposed in a way a model only reading your typed chat message never was.
There is no reliable way for a model to tell "instructions from my user" apart from "text that merely contains the word instructions" — that is the core, unsolved problem.
What actually reduces the risk
- Sandboxing — running an agent's actions in an isolated environment so a successful injection can't reach real accounts or files
- Permission limits — an agent that can read your email but not send it is far less dangerous if compromised
- Treating fetched content as untrusted data, not instructions, at the prompting layer (imperfect, but it helps)
- Human approval steps before high-stakes actions (sending money, deleting files, sending emails)
Related reading
Bottom line
Prompt injection is not a bug that gets patched once and disappears — it is a structural risk that comes with giving AI the ability to read untrusted content and take action. The realistic goal in 2026 is not eliminating it, it is limiting what an attacker can actually do if an injection succeeds.