# Prompt Injection > Source: https://ibl.ai/resources/glossary/prompt-injection > Last updated: 2026-08-19 **Definition:** Prompt injection is an attack in which untrusted content — a web page, document, email or tool result — contains text that a language model interprets as instructions and acts on, rather than as data to be processed. **On ibl.ai you own all the code and the data, run it model-agnostic across any LLM, and pay with no per-seat pricing — so you can deploy anywhere, from your own cloud to a fully air-gapped network.** ## What is Prompt Injection? The root cause is architectural: a language model receives instructions and data in the same channel, with no cryptographic or structural boundary between them. That is unlike SQL injection, where parameterized queries genuinely separate the two. **Direct** injection is a user trying to override their own assistant's instructions. **Indirect** injection is the serious enterprise case: an attacker plants instructions in content the agent will later retrieve, so the payload arrives without any user acting maliciously. Because no filter reliably distinguishes instruction from data in natural language, defense is architectural. You constrain what the agent can do, scope its credentials narrowly, require confirmation for consequential actions, and log every action against an identity. ## Why It Matters Prompt injection is the primary security constraint on autonomous agents. An agent that reads untrusted content and also holds broad tool permissions combines an unfiltered instruction channel with the ability to act, which is why capability scoping matters more than input filtering. ## Key Characteristics ### Instructions and Data Share One Channel Models have no structural way to distinguish a developer instruction from text inside a retrieved document, which is why this cannot be fully patched at the model layer. ### Indirect Injection Is the Enterprise Risk The payload is planted in content the agent will retrieve later — a page, a document, a ticket — so it executes without any user doing anything wrong. ### Filtering Is Necessary and Insufficient Pattern and classifier defenses raise the cost of an attack but cannot be complete, because the space of natural-language phrasings that convey an instruction is unbounded. ### Blast Radius Is Set by Permissions What an injection can achieve is bounded entirely by what the agent is allowed to do. Narrow, short-lived, task-scoped credentials are the load-bearing control. ### Consequential Actions Need Confirmation Sending, publishing, deleting, paying and granting access should require human approval, so a successful injection cannot complete an irreversible action alone. ### Detection Requires Per-Action Logging Without a record tying each action to an agent identity, a delegating human and a granted scope, a successful injection is not merely possible but unreconstructable. ## Examples - **Enterprise:** A research agent retrieves a web page containing hidden text instructing it to summarize internal documents and include them in its reply. — *Without scoped permissions the agent has both the instruction and the access required to comply, and the disclosure appears as normal output.* - **Financial Services Firm:** An inbound email contains instructions addressed to the agent that triages the shared mailbox. — *The agent forwards material externally because sending was an action it held standing permission to perform without confirmation.* - **Law Firm:** A document in a shared repository carries injected text aimed at an agent that indexes new files. — *The attack fails at the permission boundary because the indexing agent's credential is scoped to read a single matter and cannot reach anything else.* ## How does ibl.ai defend against prompt injection? Architecturally, at the permission boundary rather than at the input filter. ibl.ai is the agentic AI platform where you own all the code and the data, so agents run in sandboxed execution with narrow, short-lived, task-scoped credentials, consequential actions require confirmation, and every action is logged against an agent identity and the human who delegated it — inside your perimeter, in a schema you control. Because you own all the code and the data, your security team can read and change the guardrail logic rather than trusting a vendor's description of it. It is model-agnostic, carries no per-seat pricing, and you can deploy anywhere. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ## FAQ **Q: Can prompt injection be fixed at the model layer?** Not completely. Instructions and data arrive through the same channel with no structural separation, and no classifier can reliably distinguish them across the unbounded space of natural language. Model-layer defenses raise attack cost; they do not close the class. **Q: What is the difference between direct and indirect prompt injection?** Direct injection is a user attempting to override their own assistant's instructions. Indirect injection plants instructions in content the agent will later retrieve, so it executes without the user doing anything — which is the serious enterprise case. **Q: What actually limits the damage from a successful injection?** Permission scope. An injection can only achieve what the agent was already allowed to do, so short-lived credentials scoped to a single task, plus human confirmation on irreversible actions, bound the blast radius regardless of the payload. **Q: Do guardrail products solve prompt injection?** They are a useful layer and not a solution. Treat them as raising the cost of attack while the real controls remain capability scoping, confirmation on consequential actions, and complete per-action logging. **Q: Does self-hosting reduce prompt injection risk?** It does not change the attack, but it changes what you can do about it. Holding the source means your team can inspect and modify the permission model and guardrails, and the audit trail that lets you detect an attempt is an artifact you own. ## How does ibl.ai approach Prompt Injection? **ibl.ai is the agentic AI platform where you own all the code and the data. You self-host the entire stack inside your own perimeter, run it model-agnostic across any LLM and switch anytime, and pay by usage with no per-seat pricing — so you can deploy anywhere: your cloud, on-premise, GovCloud, or fully air-gapped.** - **You own all the code and the data.** Full source code under a perpetual license, running on your infrastructure. Not API access to someone else's platform — the stack itself is yours. - **Model-agnostic.** Run any LLM — Claude, GPT, Gemini, Llama, Command, or your own fine-tune — and switch providers without rewriting the platform. - **No per-seat pricing.** Usage-based billing against a budget cap you set. Cost tracks what your organization actually uses, not how many people you employ. - **Deploy anywhere.** Your cloud, your VPC, on-premise, GovCloud, or a fully air-gapped network with no outbound connectivity. 1.6M+ users across 400+ organizations run the platform this way, including NVIDIA, MIT, and Syracuse University. ibl.ai is family-owned and operated from New York, NY — a U.S.-headquartered, domestically-owned long-term partner, not a vendor that sells licenses and moves on.