Prompt injection protection
Prompt injection protection for the AI tools your teams already use
Prompt injection hides instructions in content an AI model reads, so the model works for the attacker instead of the user. PexLens reduces that risk where it starts: in prompts, responses and the extensions, packages and tools that feed your AI assistants.
What it is
What is prompt injection?
Prompt injection is an attack where text crafted by an attacker is treated by a large language model as an instruction. OWASP ranks it as the top risk for LLM applications.
Direct prompt injection
A user types instructions that try to override the system prompt, for example to reveal hidden data or bypass a policy.
Indirect prompt injection
The instructions are hidden in content the model reads on its own: a web page, a document, an email, a README, a code comment or a tool response.
Where it shows up
Every source an AI assistant reads is an input you have to trust
| AI tool | Where injected instructions can hide | What can go wrong |
|---|---|---|
| Chat assistants | Pasted documents, uploaded files, web results | Data from the conversation sent to an attacker-controlled link |
| AI coding assistants | Repository files, issues, package READMEs, dependency code | Malicious code suggested or run, secrets read from the workspace |
| AI and agentic browsers | Web pages and hidden page text | Actions taken in signed-in sessions without the user noticing |
| MCP servers and agent tools | Tool descriptions and tool responses | The agent calls tools or passes data it was never meant to |
How PexLens helps
Defence in layers, starting before the model
No single filter stops every prompt injection. PexLens combines controls on what goes into AI tools, what comes out and what those tools are allowed to load.
Inspect prompts and responses
AI Guard checks prompts and responses on the device and applies policy, so data an injected instruction tries to exfiltrate can be redacted or blocked.
Vet what feeds your assistants
Extensions, packages and AI-related components are analysed before install, cutting off a common path for hidden instructions and malicious code.
Catch drift after approval
New versions are re-checked, so a trusted extension or tool that starts behaving differently is flagged rather than silently trusted.
Limit the damage
Assume some injections will succeed, and shrink the blast radius
The impact of a successful prompt injection depends on what the AI tool can reach. Scope credentials, restrict which tools an agent may call, require approval for high-risk actions and keep an audit trail.
- Least-privilege access for AI tools
- Allow-lists for extensions and agent tools
- Human approval for sensitive actions
- Logged decisions for every AI request
FAQ
Prompt injection: common questions
What is prompt injection?
Prompt injection is an attack in which text written by an attacker is interpreted by a large language model as instructions, causing it to ignore its intended behaviour, leak data or take unintended actions.
What is indirect prompt injection?
Indirect prompt injection hides malicious instructions in content the model reads by itself, such as a web page, document, email, code file or tool response, rather than in the user’s own prompt.
What are examples of prompt injection?
Common examples include hidden instructions in a web page that an AI assistant summarizes, a comment in a code file read by a coding agent, a poisoned tool description in an MCP server, and an email that tells an AI assistant to forward data.
Is prompt injection in the OWASP Top 10 for LLM applications?
Yes. Prompt injection is ranked first (LLM01) in the OWASP Top 10 for Large Language Model Applications.
Can prompt injection be fully prevented?
Not with any single control today. Effective protection combines input and output inspection, strict limits on what AI tools can access and do, vetting of the components that feed them, and monitoring.
How does PexLens help with prompt injection?
PexLens AI Guard inspects prompts and responses and enforces data policy, and PexLens analyses extensions, packages and AI-related components before and after they are installed, reducing both the paths for injected instructions and the damage they can do.
Is agentic AI security different from prompt injection protection?
Prompt injection is one attack against agents. Agentic AI security also covers compromised components, excessive permissions, persistence and the reach of the credentials an agent can use.
Related
More on AI security
Reduce prompt injection risk across your AI tools
See how PexLens inspects AI traffic and vets the components behind it.