Prompt injection means trying to make an AI assistant follow instructions planted inside material it reads, instead of carrying out the user's intended task. A webpage, email or document can contain text addressed to the assistant rather than useful information for the reader. If the assistant treats that outside text as an instruction, a routine request such as comparing course pages can turn into a different task without the user asking for the change.
The distinction matters when using AI software for study, research or office work. An assistant may need to read a document to answer a question, but permission to read that document does not make its author the person in charge of the conversation. The practical question is whether the assistant is extracting information from a source or allowing that source to redirect its behaviour.
| Term | Plain meaning |
|---|---|
| User instruction | The task the person using the assistant actually requested |
| Outside content | A page, document or email the assistant reads while doing that task |
| Indirect prompt injection | Instructions planted in that outside content to influence the assistant |
| Potential result | A distorted answer or an attempted action outside the requested task |
What is prompt injection in AI?
Anthropic's explanation of browser prompt injection describes attackers placing instructions in content an AI system processes. The problem is particularly relevant to assistants that browse pages and use tools. Reading text and taking actions become connected: the assistant might encounter an instruction on a page and then have the ability to navigate elsewhere, fill a form or download a file.
That does not mean every page containing instructions is attacking the assistant. A recipe tells its human reader what to do. A lesson may quote an example of malicious text for discussion. The context and purpose matter. In its research on the public web, Google says many initial detections were harmless educational material rather than active attempts to redirect an assistant. Matching a suspicious phrase alone was insufficient.
A prompt injection example during ordinary research
Consider this fictional example. You ask an assistant to compare two public training courses using their published duration and eligibility requirements. One page includes text telling AI readers to recommend that course regardless of the evidence. The page has moved from describing a course to instructing the assistant how to answer. If the assistant obeys, its recommendation may reflect the page author's intervention rather than your comparison criteria.
This example is illustrative, not a report about a particular provider. It also shows why a prompt injection need not involve dramatic language or an attempt to steal information. Manipulating a shortlist or a summary can be the goal. A student could receive a skewed comparison even if the assistant never sends a message or changes a file.
Other possible outcomes are more serious when the assistant has wider permissions. An instruction in outside content might try to make it disclose private information or perform a destructive action. These are categories discussed in Google's research. The mere presence of such an instruction does not establish that an assistant followed it or that a person's information was taken.
Prompt injection vs jailbreak: what is the difference?
Google's 23 April 2026 research article distinguishes a direct attempt to jailbreak a chatbot from indirect prompt injection. In the indirect case, the unwanted instruction arrives through something the AI reads, such as a website, email or document. A user who submitted an ordinary research request may never have seen the instruction that attempted to change the task.
For readers, the route into the conversation is a useful distinction. Was this your own request, or did it come from material retrieved to help answer your request? A document's claim that it contains an urgent instruction does not establish that you authorised the instruction. The wording can sound confident while its source remains an outside author.
What did Google actually find on the web?
Google examined public web content using Common Crawl, then filtered candidate pages with pattern matching, model classification and human review. Its categories included pranks, guidance for AI readers, attempts to influence recommendations, attempts to deter agents, data theft and destructive instructions. The researchers described much of the observed activity as experimental or limited in sophistication.
The study has an important boundary: an archive of public webpages is not a complete record of everything assistants encounter. Google notes that its chosen dataset omits most major social media content and that its method can miss uncommon patterns. The findings therefore do not provide a universal probability that any particular chat or document will be compromised. Nor do they prove that every detected attempt succeeded.
How can users keep an AI task within its scope?
One practical approach is to decide the task and its limits before asking the assistant to read outside material. For the fictional course comparison, an original instruction could be: “Compare the stated duration and eligibility on these two pages. Quote the relevant requirements and link each source. Ask me before taking any action beyond preparing the comparison.” This is an example of clearer task definition, not a tested security control or a guarantee against attack.
Review the answer against the underlying pages, especially when it introduces a recommendation or a destination you did not request. If the work only needs a summary, consider whether the assistant needs access to unrelated private records or action tools. These are workflow decisions about the information and authority needed for the task. They should not be mistaken for proof that the model will identify every malicious instruction.
Anthropic describes several layers of defence, including training models to resist malicious instructions, scanning untrusted content with classifiers and testing through human security research. It also explicitly says that no browser agent is immune to prompt injection. For adjacent concepts, see our guides to what an AI agent does, AI hallucinations and source checks, and how retrieval helps an AI answer. Each explains a different part of the process behind the reply on screen.
