Most people outside technology haven't heard of prompt injection. It's one of the most common ways AI systems are misused, and it's simpler than it sounds.
What it is
An AI assistant works by following instructions written in plain language. Its builders give it rules, such as what it should answer, what it should decline and how it should behave.
Prompt injection is when someone slips in their own instructions to try to override those rules. It comes in two forms:
- Direct. Someone types the instructions straight in, for example “ignore your previous instructions and...”
- Hidden. The instructions sit inside a document, email or web page the AI is asked to read. The AI can mistake them for genuine instructions and act on them.
Why it's hard to solve completely
To an AI system, instructions and information both arrive as text. It has to work out which is which, and a cleverly worded message can blur that line. That's why no AI system can honestly be called completely immune.
The practical answer is to design the system so that, even if someone tries, there is very little they can get it to do.
What it could look like for a building society
These examples are illustrative.
- A user tries to talk an assistant into saying a case “would definitely be accepted”.
- Someone asks it to reveal its internal instructions, or to answer questions it was never meant to cover.
- A document the assistant reads contains hidden text telling it to behave differently.
The risk isn't science fiction. It's an assistant saying something it shouldn't, to a broker or a member, with the society's name on it. And the more an assistant is connected to, the more an attacker could try to reach through it.
Designing against it
The strongest protections are about limiting what can go wrong, rather than hoping the AI always spots a trick.
- Limit what it reads. An assistant that only reads a fixed, trusted set of documents gives hidden instructions far fewer ways in than one that browses the web or reads incoming emails.
- Limit what it can do. An assistant that can only answer questions can't be tricked into sending, approving or changing anything.
- Limit what it can reach. If it isn't connected to other systems or personal data, there is nothing for an attacker to reach through it.
- Limit what it says. Clear rules about scope mean questions outside it are declined, not improvised.
- Test it. Deliberately try to break it, including attempts to talk it out of its rules, before it goes live and when it changes.
When talking to any AI vendor, it's worth asking how they handle each of these. Our article on five questions to ask any AI vendor covers more.
How we approach it at AdAstr
We built our lending-criteria assistant around those limits:
- It only answers from the society's own published criteria, not the open web.
- It does one job: answering criteria questions. It isn't connected to any other systems, can't see personal data, and can't approve, send or change anything.
- Questions outside the criteria are declined rather than guessed.
- We test it with deliberately awkward questions, including attempts to override its instructions.
No system is perfect. But an assistant with very little access gives anyone trying to misuse it very little to work with.
If you'd like to talk through how we built this in more detail, I'm happy to: hello@adastr.co.uk