# Prompt injection

> Prompt injection is an attack where hostile text on a page is read by an AI model as an instruction rather than as data. When the model can click and act, the stakes rise: a defended system separates instruction from content strictly and lets the model request capabilities by name, so an injection can ask for a capability but never compose an arbitrary request.

Canonical: https://peeve.ai/glossary/prompt-injection/

## Why is injection worse when the AI can act?

Because a text-only assistant that follows an injected instruction can, at worst, say something wrong. An assistant that can click can take an action. The mitigation is architectural: the model never holds credentials or picks an endpoint, so the blast radius of an injection is the set of capabilities the user already had.

## How do you test for it?

With an injection suite that runs in CI on every deploy, seeding pages with adversarial instructions and asserting the model never escalates beyond a named capability. Separating instruction from content is the design; the test suite is how you prove the design holds as the product changes.

**Related:** Capability registry, MCP (Model Context Protocol), Semantic fingerprint.