Prompt injection
Prompt injection is an attack where hostile text on a page is read by an AI model as an instruction rather than as data. When the model can click and act, the stakes rise: a defended system separates instruction from content strictly and lets the model request capabilities by name, so an injection can ask for a capability but never compose an arbitrary request.
Why is injection worse when the AI can act?
Because a text-only assistant that follows an injected instruction can, at worst, say something wrong. An assistant that can click can take an action. The mitigation is architectural: the model never holds credentials or picks an endpoint, so the blast radius of an injection is the set of capabilities the user already had.
How do you test for it?
With an injection suite that runs in CI on every deploy, seeding pages with adversarial instructions and asserting the model never escalates beyond a named capability. Separating instruction from content is the design; the test suite is how you prove the design holds as the product changes.