Language models process instructions and data in the same stream of text. Prompt injection exploits that. A web page, email, or document might contain text such as an instruction to ignore previous rules and send data elsewhere. If the system treats that text as a command, it can be manipulated.
The risk grows when AI agents can read untrusted content and also take actions. Defenses include treating all retrieved content as data rather than instructions, limiting tool permissions, requiring approval for sensitive actions, isolating untrusted content, and monitoring for unusual behavior.