A company builds an AI-powered customer support chatbot. It's connected to their internal database — it can look up orders, check account status, send emails to customers.
The developer writes a system prompt: "You are a helpful support agent. Only answer questions about orders and accounts. Never share other customers' data."
The chatbot goes live. Customers use it every day. It works fine.
An attacker opens the chatbot and types:
The chatbot — because it can't tell the difference between a real instruction and an attacker's text — does it. It lists 10 customer accounts.
The attacker didn't hack a server. Didn't exploit a code bug. Didn't need a password. They just typed something — and the AI followed it like it was a real instruction. That's prompt injection.
Prompt injection is when someone uses text to make an AI do something it wasn't supposed to do.