Glossary
What Is Prompt Injection?
Prompt injection is an attack that smuggles malicious instructions into the text an AI model reads, hijacking its behaviour. In agentic systems it extends to tool poisoning — corrupting the data a tool returns so the agent acts on attacker-controlled input. OWASP ranks goal hijacking the top risk for agentic applications.
How injection works
A language model does not cleanly separate instructions from data — it reads both as text. If an attacker can place text where the model will read it (a web page, a document, a tool result), they can append instructions that override the model's original task. That is prompt injection.
Tool poisoning in agentic systems
Agents extend their reach through tools, and tools return data the agent then reasons over. If that returned data is attacker-controlled — a poisoned MCP response, a planted record — the injection rides in through the tool. Published benchmarks have shown high tool-poisoning success rates across popular agents, with even the most resistant models refusing only a fraction of poisoned calls.
Grounding as a defence
The durable mitigation is grounding: give the agent verifiable, coverage-qualified context so it can tell trustworthy data from injected data, and never treat absence of evidence as safety. OWASP's 2025 Top 10 for Agentic Applications puts goal hijacking — injection evolved — at the top of the list.