Concept

Prompt injection

You might say: hostile ticket text, indirect instruction, untrusted content attack

An attacker places instructions in a ticket, PR, document, web page, or tool result that the model may treat as factory instructions. The attack uses the run's authority rather than changing the model itself.

What it does
Turns ordinary input into a path toward data disclosure, unauthorized tool use, or unwanted changes.
Ask
What untrusted text can this run read, and what action could that text cause?
Typical
Direct injection arrives in the user request. Indirect injection arrives through external content such as a web page, file, ticket, or pull request.
Trouble
The run follows content as a command, exposes a secret, changes unrelated files, or sends data to an attacker-controlled destination.

What to look for

  1. A ticket or PR body containing instructions aimed at the agent
  2. A tool result that asks the agent to ignore its task
  3. A run that reads private data and has an outbound channel

Connections

Sources

  1. Simon Willison, The lethal trifecta for AI agents: private data, untrusted content, and external communication, The problem is that LLMs follow instructions in contentThe problem is that they don’t just follow *our* instructions. They will happily follow *any* instructions that make it to the model, whether or not they came from their operator or from some other source.
  2. Simon Willison, The lethal trifecta for AI agents: private data, untrusted content, and external communication, The lethal trifectaIf your agent combines these three features, an attacker can **easily trick it** into accessing your private data and sending it to that attacker.
  3. OWASP GenAI Security Project, LLM01:2025 Prompt Injection, Indirect Prompt InjectionsIndirect prompt injections occur when an LLM accepts input from external sources, such as websites or files.
  4. OWASP GenAI Security Project, LLM01:2025 Prompt Injection, Prevention and Mitigation StrategiesSeparate and clearly denote untrusted content to limit its influence on user prompts.
  5. OWASP GenAI Security Project, LLM Top 10 for Large Language Model Applications, LLM01:2025 Prompt InjectionA Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways.

Use it on your project

teardown-apply: hold "Prompt injection" (prompt-injection) from the teardown at https://teardownatlas.com/software-factory/ against my project

Paste it into a coding agent that has the teardown skills.

An AI agent wrote this map with the teardown skill. It can contain errors: check the sources before you rely on a part. About and legal