Prompt Injection and the PVE Defense
Greshake et al. (AISec 2023) established indirect prompt injection as the defining agent security problem. Attacker plants instructions in data the agent retrieves; on ingest, those instructions override the developer prompt. Treat all retrieved content as arbitrary code execution on the tool-use surface. State the indirect prompt injection threat model from Greshake et al. Name the five demonstrated exploit classes (data theft, worming, persistent memory poisoning, ecosystem contamination, arbitrary tool use). Describe the 2026 defense doctrine: untrusted content, allowlist navigation, per-step safety, guardrails, human-in-the-loop, external capture. Implement a PVE (Prompt-Validator-Executor) pattern — cheap fast validator before the expensive main model commits to a tool call. LLMs cannot reliably distinguish instructions that come from the user from instructions that come from retrieved content. A PDF, a web page, a memory note, or a previous agent turn can carry send $100 to X and the model may execute it as if the user asked. This is the defining agent security problem of 2024-2026. Every production agent has to defend against it. Attack class: indirect prompt injection. Attacker controls content the agent will retrieve: web page, PDF, email, memory note, search result. When ingested, the instructions in that content override the developer prompt. Demonstrated exploits against Bing Chat, GPT-4 code completion, synthetic agents:. Data theft — agent exfiltrates conversation history to attacker-controlled URL.…
Prompt Injection and the PVE Defense: Greshake et al. (AISec 2023) established indirect prompt injection as the defining agent security problem. Attacker…
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.