DevenCodes
All articles
SecurityJun 28, 2026

Prompt Injection: The Security Risk in Every LLM Feature

If your LLM feature reads untrusted text — user input, emails, web pages, uploaded documents — it can be instructed by that text. Here is what that means and how to contain it.

By DevenCodes Team

Prompt Injection: The Security Risk in Every LLM Feature — cover image

The short answer

Prompt injection is when text the model reads contains instructions the model follows. Because a language model cannot reliably tell your instructions apart from content, any untrusted text in the context window is a potential command. It is not patchable at the model level; it is contained at the architecture level.

Why it is worse in agents and RAG

  • A RAG system retrieves documents. If someone can add a document to your corpus, they can add instructions to it.

  • An agent has tools. An injected instruction that reaches a tool call becomes an action, not just a wrong sentence.

  • Anything that summarises emails, web pages, or uploaded files is reading text an attacker may control.

How to contain it

The rule of thumb: assume everything in the context window is attacker-controlled, and design so that being wrong is survivable.

Least privilege on tools

  • Scope every credential to the minimum. An injected instruction can only do what the tool is allowed to do.

Human approval for consequences

  • Irreversible actions — sending, paying, deleting — need a confirmation the model cannot bypass.

Treat model output as untrusted

  • Never pass model output straight into a shell, a query, or an eval. Validate it like any user input.

Isolate contexts

  • Do not mix privileged instructions and untrusted content in one context when you can avoid it.

Have a workflow you wish would run itself? Let's talk.