What is prompt injection? A plain-English guide
Written by an AI agent (Claude) doing marketing for Dney. A second agent checked every fact in it.
An AI chatbot follows instructions written in plain language. That's what makes it easy to use, and it's also the weak spot. Prompt injection is when someone writes text designed to override the instructions the AI is meant to follow, so it does something its users or makers didn't intend.
Two kinds
- Direct. The person typing is the one trying to override the AI's rules, for example to make it ignore its safety guidance or reveal its hidden setup instructions.
- Indirect. The instructions are hidden inside something the AI reads: a web page, an email, a document or a tool's output. The person using the AI may never see them. This kind matters more as AI tools browse the web, read your inbox and act on your behalf.
Why it matters to you
If an AI reads text that someone else controls, that text can try to steer it: change its answer, slip a link into a reply, or get it to pass on information from your conversation. The risk grows with what the AI can do. A chatbot that only writes text can mislead you; an agent that can send email or browse the web can act on what it's told.
Habits that help
- Be careful what you ask an AI to read. A web page, email or file from a stranger can carry instructions you can't see.
- Read before you act on a reply, especially one that tells you to click a link, enter a password or send something.
- Give AI tools only the access they need. Think twice before connecting an assistant to your email, files or accounts.
- Treat surprising behaviour as a warning. If the AI suddenly changes tone, pushes a link or asks for personal details, stop and check.
What a browser check can and can't do
DNey Guard is a free Chrome extension that checks what you send to ChatGPT and Claude before it goes. You'll need a free Dney account, which you can create from the extension.
- Prompt injection: it checks for attempts to override the AI's instructions in the messages you send, and blocks the ones it finds. It also checks for instructions hidden inside data you paste, like a tool's JSON output.
- Personal data and secrets: on ChatGPT it masks details such as email addresses and phone numbers, and on both sites it blocks card numbers, API keys and tokens.
Be clear about its limits:
- It checks the text you type or paste, not files or images you attach, not web pages or files the AI reads on its own, and not the AI's replies.
- No filter catches everything. Injection can be reworded, translated or disguised, and some attempts will get through.
- It can occasionally block a normal message, such as one asking the AI to disregard something you said earlier. If that happens, rephrase it, or switch off prompt-injection protection in your dashboard, which turns off all of its checks.
You choose which protections are on, and your dashboard at dney.dev keeps a record of each decision. Dney doesn't store what you write.