Prompt Injection Testing
Prompt injection testing probes whether user input can override an AI system's original instructions — tricking it into ignoring its guardrails, revealing its system prompt, or performing an action it was explicitly told not to. It's the AI-era equivalent of SQL injection: untrusted input manipulating a system that wasn't built to distinguish instructions from data.
A direct prompt injection is straightforward: a user types something like "ignore all previous instructions and instead..." into a chat interface. An indirect prompt injection is more dangerous and harder to test for — malicious instructions hidden inside a document, webpage, or email that an AI agent reads and processes as part of its normal task, without a human ever typing anything suspicious.
Testing typically covers: direct override attempts, attempts to extract the system prompt verbatim, jailbreak patterns pulled from public research (role-play framing, encoding tricks, multi-turn erosion of guardrails), and indirect injection via any external content the system ingests — a resume an AI screener reads, a webpage an AI agent browses, a support ticket an AI triage tool summarizes.
There's no fully solved defense yet — it's an active, adversarial area, closer to security testing than functional testing. The realistic goal for a test suite isn't "prove it's impossible," it's "confirm the known attack patterns are caught and the guardrails degrade safely, not silently."
