Prompt injection FAQ: common questions from business leaders

Can prompt injection be fully fixed?

Not today. AI models read instructions and information as one stream of text, so they can sometimes follow the wrong thing. Vendors have improved defenses, but the safest approach is layered controls rather than relying on the model alone.

How is prompt injection different from jailbreaking?

Jailbreaking is a user trying to talk a model out of its own safety rules. Prompt injection usually targets the people using the AI: hidden text in content the AI reads causes it to act against its user's wishes.

Who is most at risk?

Anyone using an AI that reads outside content and can also take actions. An assistant that only chats is lower risk than one that can send email, access files or move money.

Can an email really attack my AI?

Yes. Instructions can be hidden in white text, small print or metadata. In 2025, researchers showed a single crafted email could make Microsoft 365 Copilot leak internal data (EchoLeak). Microsoft fixed it before public disclosure, and there was no sign it was exploited.

Does a better model solve it?

It helps, but doesn't remove the risk. In one test, even the most resistant of seven models was fooled occasionally, and repeated attempts raised the odds.

Are AI agents riskier than chatbots?

Generally, yes, because agents act on your behalf. Limiting their permissions and requiring approval for sensitive steps matters more as autonomy grows.

What should I ask an AI vendor?

• Can content the AI reads change what it is told to do?
• Does it ask for confirmation before sending, paying or deleting?
• Is each customer's data isolated, including caches?
• What access does it need, and can that be narrowed?

Where do I start?

Read What is prompt injection?, then review your tools against our Responsible AI-by-Design Framework.