Prompt injection is an attack that hides malicious instructions inside the text an AI model reads, causing the model to follow the attacker's instructions instead of its own rules. Those instructions can arrive directly from what a user types, or indirectly from content an agent fetches, such as a document, email, ticket, or web page.
Why prompt injection is different from a normal exploit
Traditional software attacks target code and infrastructure. Prompt injection targets the model's reasoning. A language model cannot reliably tell the difference between the instructions it was given and instructions that appear inside the data it is asked to process, so attacker text embedded in a web page or a support ticket can be read as a command. There is no single input field to sanitize, because the whole context window is the attack surface.
Direct versus indirect prompt injection
- Direct prompt injection: A user types adversarial instructions into the prompt, for example telling the model to ignore its system prompt or reveal hidden content.
- Indirect prompt injection: Instructions are planted in content the agent later reads, such as a document, email, calendar invite, or web page. The attack fires when the agent ingests that content, with no action from the legitimate user.
Why it is the defining threat for agents
Agents do not just answer questions, they act: they call tools, update records, send messages, and move data across many steps. Because agents routinely read untrusted content, a single injected instruction can be steered into leaking sensitive data, invoking a tool the agent should not use, or taking an unauthorized action. That turns a hidden string of text into a financial, legal, and regulatory exposure.
How to defend against prompt injection
Output filters that only check the final answer are not enough, because an unsafe action can fire long before the last message. Real defense runs on the execution path: inspect prompts, responses, and tool results in real time, treat fetched content as data rather than instructions, redact sensitive fields before they reach a model or a log, and gate high-risk actions behind human approval. This is the job of an AI firewall.
How Blunom implements it
Blunom's AI Firewall inspects every prompt, response, and tool result inline, on the way in and on the way out. It neutralizes injected instructions by treating fetched content as data, detects and redacts PII and other sensitive patterns, blocks high-severity attacks, and pauses risky actions for human approval. Every detection, redaction, and block is written to the audit trail, so security and compliance can see exactly what was caught and why.