What is prompt injection?

An AI assistant struggles to tell what you asked from what it reads while working. Prompt injection exploits that weakness: someone slips instructions into a web page, an email or a document, and the AI that reads them starts obeying them. An overly docile intern, in short, following orders found in the morning mail instead of sticking to yours.

The danger grows with access. An assistant answering your questions in a chat window risks little. An assistant plugged into your inbox, calendar and files, much more: a single booby-trapped email can make it summarize your private messages and send them elsewhere. What happens when the AI reads a document you never checked? You won’t necessarily know, and that is exactly the problem.

There is no definitive fix, because the flaw lies in the very nature of these models: any text they read is a potential instruction. The common-sense defense fits in one word, compartmentalize. Give the assistant strictly what it needs, when it needs it, never permanent access to your entire digital life.

Where it plays out: chapter 13 of the book sets the rules for cautious use of AI assistants, the AI assistants category lists the most respectful options, and the guide to leaving Gemini and ChatGPT helps you take back control.