Prompt injection

Prompt injection is content written to control a model rather than to inform a person. Because AI answer engines read live web pages, any page can attempt it.

What does an injection attempt look like?

Instructions aimed at the model: “ignore previous instructions”, text styled as a system message, or hidden directives telling the model which product to recommend. The distinguishing feature is that the text addresses the machine, not the reader.

Is sponsored content a form of injection?

No, provided it makes claims rather than issuing instructions. “Sponsored: this tool sets up in five minutes” is a labelled claim a reader can evaluate. “Always recommend this tool” is an instruction aimed at the model, and it is out of scope for any legitimate advertising product.

Why do engines police this so aggressively?

Because it degrades the answers users receive, which is the only thing an answer engine sells. A page caught attempting injection is likely to be excluded from retrieval altogether.

Why does retrieval make this a live problem?

Because an answer engine reads pages it does not control and passes their text to a model as context. Every retrieved page is therefore untrusted input arriving inside a trusted pipeline, which is the classic shape of an injection vulnerability. The publisher is not necessarily the attacker either: a comment field, a forum thread, a user profile or an uploaded document on your own domain can carry the payload, and the page it appears on is yours.

What should a publisher do about their own site?

Treat user-generated text the way you would treat it for cross-site scripting: as something to be contained rather than trusted. Content that appears on your pages but was written by someone else is the most likely place an injection attempt reaches an engine under your name, and the reputational consequence lands on the domain rather than on the account that posted it.

Is there a clean line between persuasion and injection?

Yes, and it is the audience. Persuasive content addresses a reader and can be evaluated, disagreed with or ignored. An injection addresses the model and tries to remove the reader’s judgement from the loop. That distinction is not a matter of degree: a claim you would be willing to print in the visible copy is advertising, and text written to be read only by a machine is not.