Prompt Injection

Untrusted text starts giving the model orders

Your instructions, the user's question and whatever the system retrieved all arrive in one context window, and that window has no notion of trust. Text is text.

So a web page, a document, a code comment or a tool result can contain something shaped like an instruction, and the model may follow it — including instructions to ignore your rules or to use tools in ways you did not intend.

The defense is not a better prompt. Telling the model to ignore instructions in retrieved content is a request, not a control, and it can be argued out of. Treat everything the system retrieves as data rather than authority, scope tool permissions tightly, and put a human in front of anything expensive to undo.