Prompt Injection
An attack in which text from an untrusted source is interpreted by the model as instructions rather than as data.
Direct injection is a user typing "ignore your instructions". Indirect injection is more dangerous and much harder to see: instructions hidden in a web page, a document, an email or a code comment that an agent later reads while doing something else entirely.
There is no known complete defence, because the model has no reliable channel separation between instruction and data. Mitigations are architectural rather than model-level: treat all retrieved content as untrusted, give the agent least privilege so a successful injection cannot do much, require human approval for consequential actions, and constrain outputs to a schema rather than accepting free-form commands.
The compounding risk is the combination of private data access, exposure to untrusted content, and the ability to communicate externally. Any two are manageable; all three in one agent is an exfiltration path.