Guides, examples and references
Learn about prompt injection
Every guide on this site, grouped by the question it answers. Each one names its primary sources at the foot of the page, states what the scanner can and cannot see, and can be read without opening the workbench.
Understand the risk
What prompt injection is, how it differs from the attacks it is confused with, and how the field got here.
What is prompt injection?
Learn how untrusted instructions can redirect an AI workflow, why downstream authority matters, and why detection is only one review aid.
Prompt injection vs jailbreaking: why the difference matters
Prompt injection targets the application that reads untrusted text; jailbreaking targets the model’s own safety training. Why conflating them leads to the wrong defences.
Indirect prompt injection: attacks that arrive inside documents
How instructions planted in emails, web pages, tickets and files reach an AI system through retrieval or tools, with the documented incidents that made the risk concrete.
A short history of prompt injection, 2022 to 2026
From the first demonstrations against GPT-3 to zero-click leaks in enterprise assistants: the incidents, papers and vendor statements that shaped the field.
Prompt injection glossary
Direct and indirect injection, jailbreak, system prompt, RAG, agent, tool call, exfiltration, ASCII smuggling, spotlighting and more, defined for non-specialists.
Where it shows up
The systems that read untrusted text on your behalf, and the documented incidents in each.
Prompt injection in AI agents: tools, data and the lethal trifecta
Why an agent that reads untrusted content, holds private data and can send messages is exposed by design, and what the published defences actually change.
Prompt injection through email and calendar invites
An assistant that reads your inbox reads what attackers send you. Zero-click leaks, calendar-invite attacks and the confirmation steps vendors have added.
AI browsers and prompt injection: when the page gives the orders
Agentic browsers act on pages they read. What Brave found in Comet, what OpenAI says about Atlas, and how to use an AI browser without handing it your accounts.
Prompt injection in coding assistants: rules files, issues and repositories
How hidden instructions in configuration files, public issues and source comments have reached AI coding agents, and the review habits that catch them.
RAG poisoning: prompt injection through knowledge bases
Retrieval-augmented systems trust whatever they retrieve. How poisoned documents reach the model, why relevance ranking helps attackers, and how to segment the corpus.
Hidden text in résumés and academic papers
White text, tiny fonts and invisible characters are being used to steer AI screening and AI peer review. What the studies found and how reviewers can respond.
Multimodal prompt injection: images, audio and screenshots
Instructions do not have to be text. How images and audio have carried hidden instructions into multimodal models, and why a text scanner cannot see them.
How text hides
The channels a reader never sees and a model always reads, and how data leaves once an instruction lands.
Hidden prompt injection in HTML, Unicode and encoded text
See where instructions can hide in supplied HTML, Markdown, links, comments, metadata and Unicode, plus the layers this browser scanner cannot inspect.
Invisible Unicode characters: zero-width, bidi and tag code points
Which invisible characters exist, why legitimate text needs some of them, and how attackers use the same code points to hide instructions from human readers.
How prompt injection exfiltrates data through AI assistants
Markdown images, links and tool calls have all been used to move private data out of an AI assistant. The mechanisms, the documented fixes and what to check.
Prompt injection examples and hard negatives
Compare curated suspicious instructions with quoted research, policies, code and other benign context that a useful scanner must handle carefully.
Defend and review
Practical routines for people who paste text into AI tools, for the teams that build them, and for the day something gets through.
How to check a document before pasting it into an AI
A practical routine for individuals: paste as plain text, reveal hidden formatting, read what a model will read, and decide what to strip before you share it.
Prompt injection defences for developers: what actually holds
Least privilege, human approval, provenance marking, dual-model designs and capability control, ranked by what they can and cannot promise.
Prompt injection incident response: what to do when you find one
Contain the source, preserve the bytes, trace what the assistant did, rotate what may have leaked and report responsibly. A checklist for individuals and teams.
About the scanner
What this browser-local scanner reads, how it is evaluated, and exactly where it stops.
How the prompt injection scanner works
Follow the bounded local acquisition, channel extraction, deterministic detection, evidence mapping and coverage reporting pipeline.
What we detect
Zero-width and bidi characters, HTML comments, hidden elements, metadata, link destinations, encoded runs and the instruction patterns this browser-local scanner reports.
Methodology
Review the pinned scanner policy, detector families, source mapping, hard-negative design, release thresholds and evidence still required for launch.
Limitations
Understand unsupported formats, English-language limits, public-rule evasion risk, partial coverage and the downstream controls detection cannot replace.
Frequently asked questions
Whether your text leaves the browser, what a finding and a clean result each mean, which formats are read, and why the detection rules are public.
How these guides are written
Each guide is researched against the primary sources it lists: vendor security bulletins, peer-reviewed papers, standards documents and first-hand disclosures from the researchers who found the problem. Dates, names and figures are taken from those sources rather than from secondary summaries. Guides are drafted with AI assistance and are the responsibility of the operator, who corrects errors reported through the contact page. The about page states the editorial policy in full.
No guide publishes a working attack payload or explains how to evade a detector. Where an example instruction is quoted, it is quoted the way a security policy quotes it: as inert evidence for review, never as something to run.