---
schema: 1
type: term
title: prompt injection
description: >-
  Prompt injection is an attack in which an LLM — which is imminently gullible
  and treats all text as effectively executable — follows malicious instructions
  embedded in untrusted text (such as emails or web pages), especially when that
  text flows into an agent capable of taking actions with irreversible side
  effects.
canonical: >-
  https://liquidgold.cc/channel/everyinc/explore/term/prompt-injection-ab0dcdaa2e03
markdown: >-
  https://liquidgold.cc/channel/everyinc/explore/term/prompt-injection-ab0dcdaa2e03.md
llms: null
parent: 'https://liquidgold.cc/channel/everyinc/llms.txt'
channel: everyinc
updated: '2026-10-23T22:12:35.346Z'
language: null
children: []
---


# prompt injection

Canonical: https://liquidgold.cc/channel/everyinc/explore/term/prompt-injection-ab0dcdaa2e03

Parent: [Channel index](https://liquidgold.cc/channel/everyinc/llms.txt)

## Definition

Prompt injection is an attack in which an LLM — which is imminently gullible and treats all text as effectively executable — follows malicious instructions embedded in untrusted text (such as emails or web pages), especially when that text flows into an agent capable of taking actions with irreversible side effects.

**Prompt injection** appears in this channel's material as the security problem Alex Komoroske predicts will become widely known in the industry within 6–12 months — and he argues it may be the era's defining security issue [^759f5666-c356-59d0-8a71-9b53e5735bf7@3699]. His framing of *why* it is so serious contrasts it with an older problem:- **SQL injection is child's play** by comparison: SQL is highly regular, so escaping inputs largely obviates it. - **LLMs are imminently gullible and make all text effectively executable.** Any text an agent reads can act as instructions. - The combination is explosive: bring in **untrusted text** (emails, web pages) alongside **tool use with irreversible side effects** — and *any network request can be an irreversible side effect*. [^759f5666-c356-59d0-8a71-9b53e5735bf7@3699]A concrete scenario from the source: a spammer's email that did not hit the spam folder can instruct an agent to send financial data to an attacker's site. The key point is that the threat model is **not badly behaved MCP integrations** — it is **any context that flows in through them**. Even if every MCP integration you installed is trustworthy, the text moving through the system is the attack surface.Komoroske argues that fixing prompt injection **requires a different architecture at the security and privacy layer**, and that MCP punts on the problem with a few preemptive dialogs. Large-scale attacks have not hit yet, in his view, only because we are still in the *tinkering phase* rather than wide deployment.   The related ChatGPT operator anecdote shows the stakes even without malice: a reporter asked for cheap eggs, logged into Instacart, and walked away — 30 minutes later very expensive eggs arrived because the agent acted too eagerly. Agents taking irreversible actions is the precondition that makes injected instructions dangerous. - **Prompt injection** exploits gullible LLMs that treat any incoming text as executable instructions. - It becomes dangerous when untrusted text combines with **tool use with irreversible side effects**. - The threat is **any context flowing through integrations**, not just malicious integrations themselves. - Komoroske believes a fix requires a **new security/privacy architecture**; MCP currently punts on it. - Large-scale attacks haven't hit yet because we're still in the tinkering phase.