Prompt injection

Direct and indirect prompt injection compared

Affected tools

• AI chat tools
• AI copilots
• Browser agents
• Retrieval-augmented assistants
• MCP-connected agents

How it usually happens in the browser

• Someone pastes an untrusted page into an AI tool.
• The content hides an instruction such as “ignore previous instructions.”
• An agent with browser, email, or file access obeys it.
• The model leaks data or takes an unsafe action.
• Attackers iterate cheaply, and detection stays imperfect.

What traditional defenses miss

• Input validation was built for code, not natural language.
• LLMs make no distinction between data and instructions.
• People assume “summarize this page” is a safe request.
• Few tools trace page to prompt to output to action.
• Tool access turns a bad answer into a real action.

Mitigation checklist

• Constrain model behavior with clear, narrow instructions.
• Give agents only the tools and access each task needs.
• Label external content as data, not instructions.
• Require human approval before high-risk actions.
• Filter inputs and outputs, and validate output formats.
• Red-team your most used AI workflows on a schedule.

Where browser isolation fits

• Shield runs the page in a browser that is not on your computer, destroyed when you close the tab.
• Shield moves page execution off your device while you research.
• Isolation changes where a page runs. It does not change what a model obeys.
• Agent builders reach the same routing and isolation through a ready skill.
• Your agent stack still owns its permissions and logs.

FAQs.