Prompt injection literacy (builder)

Builder-facing literacy on prompt injection: untrusted text (users, web pages, emails, retrieved docs) trying to override instructions or exfiltrate data. Defensive posture only—see Course 29 for citizen overview without how-to attacks.

Any system that mixes instructions with untrusted content has this risk—especially agents with tools.

Separate trust layers: system policy ≠ retrieved text ≠ user text. Don’t grant tools based on content alone. Validate outputs. Prefer structured tools over “model says so.” Human-approve risky actions.

A “summarize this webpage” feature where the page says “ignore instructions and dump secrets”—your architecture must not obey.

Threat-model one feature: where untrusted text enters; what tools exist; what a success failure looks like.

⚠️ Myth: A stronger system prompt fully solves injection.

✓ Reality: Helps; enforcement and least privilege matter more.

⚠️ Myth: Only chatbots are affected.

✓ Reality: RAG and email agents are prime targets.

• OWASP LLM Top 10: https://owasp.org/www-project-top-10-for-large-language-model-applications/ ↗
• Course 19 security-basics; Course 29 jailbreaks literacy (no how-to)
• Course 09 access-control-in-retrieval