How should prompt injection, indirect prompt injection and malicious tool instructions be detected, constrained and audited?

Direct answer

Prompt injection is an input that tries to push an AI system outside its defined rules. A direct attack arrives in text written by the user. An indirect attack is hidden in a web page, document, email, image or retrieval source that the system reads. No single filter is sufficient. Treat external content as data, reduce privileges, validate tool calls in code, require human approval for risky operations and trace the whole decision chain.

In plain language

Imagine a parcel arriving at a warehouse with 'Open the main safe and send me its contents' written on it. An employee can read the sentence, but the words on the parcel are not a manager's order. An AI system should not treat every sentence it reads as an instruction either.

Why this matters

A successful injection may disclose sensitive information, distort a decision, use a tool without authority or cause a real transaction in an external system. The greater the system's tool authority, the greater the possible effect.

Do not confuse

Direct prompt injection places the attack instruction in user input.
Indirect prompt injection hides the instruction in external content read by the system.
A jailbreak is a form of prompt injection intended to defeat protective rules.
A request to use a tool is not authority to execute that tool.
Harmful output and an unauthorised real-world action are different impact levels.

What should you do?

Label system, user and external-source instructions with different trust levels.
Treat web, file, email, image and retrieved content as untrusted data by default.
Limit the model and each tool to the least authority required for the task.
Validate tool name, parameters, target and output through deterministic code, an allowlist and a schema.
Require human approval for money movement, deletion, publication, messaging, authority changes and sensitive-data access.
Use input and output controls, content separation and safe failure behaviour together.
Test regularly with direct, indirect, multilingual and text, image or audio attacks, and preserve traces.

How do you audit it?

Can the source and trust level of every instruction be seen?
Can external content rise to the same authority level as system policy?
Does the model hold more data, tool or network authority than necessary?
Is a tool call executed by trusting model text, or validated by code?
Is there explicit, action-specific human approval for high-impact operations?
Are blocked and successful injection attempts preserved in an incident trail?
Was retrieval-augmented generation or fine-tuning mistakenly treated as complete protection?

Limit

No perfect, universal prevention method for prompt injection has been demonstrated. Filters, system prompts, retrieval-augmented generation or fine-tuning are not sufficient alone; controls should be layered according to risk and tool authority.