# Prompt injection

> Hidden instructions in outside content, like a web page or email, that try to make an AI agent do something you never asked for.

**Category:** ChatGPT

**Prompt injection is when content an AI reads tries to give it orders.** An agent that browses, reads email, or opens files can meet text written to hijack it: "ignore your task and send this file to...". The risk grows with what the agent can do.

It matters most for agents like [Work](/glossary#chatgpt-work), [Codex](/glossary#codex), connected [apps](/glossary#chatgpt-app), and event-triggered tasks. The defences are habits: keep tasks **scoped** to trusted sources, give the **narrowest access** that works, keep **approvals** on anything that sends, pays, or shares, and stop a task that touches things you never mentioned.

## At work

An automation reads incoming client emails? Let it summarise and draft, never send or share on its own. A strange instruction in an email can't do harm if the agent can't act on it.

## Often confused with

Jailbreaking. A jailbreak is a user trying to talk the AI out of its rules; prompt injection is a third party hiding instructions in content the AI reads.

## Related terms

- ChatGPT Work
- App (ChatGPT)
- Sandbox

## See it in a lesson

[ChatGPT Work: tasks on your files](/en/learn/chatgpt/working-smart/chatgpt-work-on-your-files)

## Further reading

- [Prompt injection (Wikipedia)](https://en.wikipedia.org/wiki/Prompt_injection): A well-sourced overview of the attack.
- [LLM01:2025 Prompt Injection (OWASP)](https://genai.owasp.org/llmrisk/llm01-prompt-injection/): The security community's description and defences.
- [Developer mode and MCP apps in ChatGPT](https://help.openai.com/en/articles/12584461-developer-mode-apps-and-full-mcp-connectors-in-chatgpt-beta): OpenAI's warning for custom apps.

---

Last updated: 14/10/2026  
Source: Rollo Academy glossary