Prompt Injection for Defenders: What It Is and How to Think About It

Overview

Prompt injection is often described as 'SQL injection for LLMs' — a useful starting point, but incomplete. This episode walks through what prompt injection actually is, direct vs indirect variants, where it matters most, and how to think about defence without falling into false comfort from simple filters.

Key takeaways

• Prompt injection is the injection of attacker-controlled instructions into the model's context
• Direct prompt injection comes from the user; indirect comes from data the model reads (web pages, documents, emails)
• Indirect is usually the bigger risk because it bypasses user intent entirely
• Defences are layered: input sanitisation helps little, trust boundaries and output validation help more, human approval for sensitive actions helps most
• Treat the model as an untrusted component — never grant it authority it cannot safely exercise

Episode script

[OUTLINE — full script to be expanded before recording]

Open: why prompt injection matters now.

Section 1 — What it actually is. Instructions mixed with data in a shared context window.

Section 2 — Direct vs indirect. Direct = user types malicious prompt. Indirect = model reads a document, webpage, email containing the attack.

Section 3 — Why indirect is usually worse. It bypasses user intent.

Section 4 — What doesn't defend well. Input filtering. Simple keyword blocks. Prompt 'guarding' in system prompts.

Section 5 — What helps. Trust boundaries (the model can suggest but not execute). Output validation. Human approval for sensitive actions. Principle of least authority applied to agent tools.

Section 6 — Real-world examples. Email summarisers, browsing agents, document Q&A systems.

Outro.

References

• OWASP LLM Top 10 →