A language model cannot reliably tell your instructions apart from the text it is asked to process. If your app feeds it a web page, an email, a support ticket, or a file, any instructions hidden in that content can steer the model. This is called indirect injection. Direct injection is a user typing instructions that try to override yours.
The danger grows with what the model is allowed to do. A chatbot that only answers questions can leak its prompt. An agent connected to your database, email, or code repository can be tricked into reading private data, sending it out, or running commands. AI coding assistants face the same risk when they read untrusted files, issues, or documentation.
There is no complete fix, so limit the damage. Give the model the least access it needs, keep secrets out of prompts, treat its output as untrusted input before using it in queries or commands, separate untrusted content from instructions, and require a human to approve risky actions such as sending data, deleting records, or spending money.