# Prompt injection

> VI: https://5ac.vn/wiki/prompt-injection/ · EN: https://5ac.vn/en/wiki/prompt-injection/ · lang: en · spec_as_of 2026-10-19 (spec no formal spec) · cluster C13

A class of vulnerability where prompts from untrusted sources change a model's behavior; the defense sits outside the model, in filtering, permissions and logging.

---
## Definition

Prompt injection is a class of vulnerability, not a bug in one model: a prompt from an untrusted source changes a model's behavior or output in a way nobody intended. OWASP's LLM01:2025 definition reads "A Prompt Injection Vulnerability occurs when user prompts alter the LLM's behavior or output in unintended ways." OWASP separates two shapes: indirect means the prompt arrives through outside content the model reads — a website, a file, an email; direct means it arrives with the user's own input.

The foundational study *Not what you've signed up for* (arXiv:2302.12173) names the root cause: LLM-integrated applications "blur the line between data and instructions." OWASP records that retrieval-augmented generation and fine-tuning do not fully mitigate this, and that models being stochastic means no fool-proof prevention — so the protective layer sits outside the model.

## Mechanism

Four defensive layers travel together, each covering what the others cannot:

| Layer | What it does | Why it works |
| --- | --- | --- |
| Filtering | input and output filters on incoming requests and outgoing answers | unfamiliar content is stopped before the model reads it and before an answer reaches a customer |
| Privilege control | separate API tokens for the application, business functions handled in code, access kept at the minimum needed | the blast radius stays inside a narrow set of rights instead of the whole system |
| Tools by role | each agent receives only the tools its own job needs | one affected run does not reach the other agents |
| Outbound and logging | credentials and sensitive detail stripped before anything is sent out, every action recorded | information does not travel with the answer, and an incident leaves a trail |

Research and practice both back this order. The position paper *Architecting Secure AI Agents* (arXiv:2603.30016) argues that context-dependent security decisions may still need a model, but only inside designs that tightly constrain what the model can observe and decide; ambiguous cases go back to people. The [AI guardrail](/en/wiki/guardrail/) entry lists input filtering as one of four blocking points, [Sandbox](/en/wiki/sandbox/) holds the isolation once an action has slipped through, and [Audit log](/en/wiki/audit-log/) supplies the trail afterward. The multi-agent OS piece agrees: each agent gets only the tools it needs, narrowing the blast radius of prompt injection attacks.

## Application context

5ac's cited skill set for 2026 puts prompt injection defense next to zero-trust tool access and audit trails — one layer, not one product.

The AI agents platform guide notes vendor teams already solved prompt injection: paying for their scar tissue is cheaper than acquiring your own. What stays with the company: which data the agent may read, which tools it may call, which outbound paths are open.

Inside 5ac's runtime, the Grok Bot versus Hermes Agent comparison records that A2A v1.0 in Hermes Agent 0.20.4 ships with per-peer auth, prompt-injection filtering, outbound credential redaction, rate limiting and audit logging — and that 5ac paused A2A for customer deployments on 13/08. A capability that exists is not switched on.

The AI engineering skills map puts incident response for model failures and prompt injection in the work after deployment: an SMB that filters, limits permissions and keeps a log can investigate; one that only trusted the model cannot.

## Sources fetched

- <https://genai.owasp.org/llmrisk/llm01-prompt-injection/> — LLM01:2025 Prompt Injection: definition, the two shapes, mitigation measures, the limits of RAG and fine-tuning — accessed 2026-10-19
- [AI Agent Trends 2026: From Single Agents to Autonomous Agent Networks](/en/blog/ai-agent-trends-2026-agentic-ai-enterprise-vietnam/) — 2026 security skill set: prompt injection defense, zero-trust tool access, audit trails — accessed 2026-10-19
- [AI Agents Platform: Complete Guide for Business (2026)](/en/blog/ai-agents-platform/) — platform teams solve prompt injection first, scar-tissue argument — accessed 2026-10-19
- [Grok Bot vs Hermes Agent: Why 5ac Chooses a Composable Runtime](/en/blog/grok-bot-vs-hermes-agent-why-5ac-chooses-composable-runtime/) — A2A security defaults with filtering and redaction, the 13/08 pause — accessed 2026-10-19
- [What Is a Multi-Agent OS? The Enterprise Architecture Behind Reliable AI Agents](/en/blog/what-is-multi-agent-os/) — tool governance narrows the blast radius of prompt injection attacks — accessed 2026-10-19
- [Andrew Ng's AI Engineering Skills Map: The 6 Skills That Actually Matter](/en/blog/andrew-ng-ai-engineering-skills-map/) — incident response for model failures and prompt injection — accessed 2026-10-19
- <https://arxiv.org/abs/2302.12173> — Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (v2) — verified via arXiv API 2026-10-19
- <https://arxiv.org/abs/2603.30016> — Architecting Secure AI Agents: Perspectives on System-Level Defenses Against Indirect Prompt Injection Attacks (v1) — verified via arXiv API 2026-10-19

## Related

- [AI guardrail](/en/wiki/guardrail/)
- [Sandbox](/en/wiki/sandbox/)
- [Audit log](/en/wiki/audit-log/)
- [Agent governance](/en/wiki/agent-governance/)
- [Agent orchestration](/en/wiki/agent-orchestration/)