Prompt injection: the details
There are two variants. In the direct one, whoever is writing to the assistant tries to get around its rules. In the indirect one, the instruction travels hidden in the content: a résumé with invisible text asking for a high score, or an email ordering the inbox to be forwarded. The second is the dangerous one in an agent with tools, because the attacker doesn’t need access to the system: it’s enough for the agent to read something of theirs.
No filter today prevents it completely, and it ranks as the first risk on OWASP’s list for applications built on language models. What works is limiting the damage: minimal permissions per tool, separating what the agent can read from what it can do, human confirmation for actions with outside effects and no secrets inside the prompt.