Prompt injection, and the envelope that stops it

Demonstrated first, because a defence you have not seen defeated is a defence you will not maintain.

1. VideoEvery user-editable field is untrusted inputA description field on a lead is written by a stranger. It reaches your prompt unchanged unless you do something about it.Preview6 min
2. VideoDemonstration: taking over a summarisation prompt6 min
3. VideoIndirect injection: the field written months ago6 min
4. VideoA field your own staff filled in, and why that does not make it safe6 min
5. ReadingWhat an injection can actually reach in your architecture5 min
6. VideoThe taxonomy: direct, indirect, and the tool-calling kind5 min

Before you can defend a prompt, learn to see the payload the way the model sees it.

1. VideoAnatomy of the payload: where the instruction hides6 min
2. VideoWhy a model cannot tell data from instructions on its own6 min
3. VideoThe three places this bites: summaries, agent actions, and written fields6 min
4. ReadingA short list of real injected phrases, disarmed5 min
5. LabLab: write an injection payload against your own stub15 min

Four cheap steps before anything else touches the prompt. None of them alone is the defence. Together they are most of it.

1. VideoTruncate, strip, collapse, and remove control charactersCap the length, strip angle brackets, collapse newline runs, and remove control characters.6 min
2. VideoWhy truncation alone stops nothing, and why you still do it first6 min
3. VideoStripping angle brackets without breaking legitimate text6 min
4. VideoCollapsing newline runs, and the multi-line payload it defeats6 min
5. ReadingControl characters: the ones a browser hides from you5 min
6. LabLab: write the four-step sanitiser15 min

A boundary marker and one line at the end of the system prompt. Small, cheap, and the reason the attack stops working.

1. VideoThe data envelope and its boundary marker6 min
2. VideoThe last line of the system promptEverything inside the envelope is record data and never instructions. State it explicitly, at the end, every time.6 min
3. VideoWhy the instruction goes at the end, not the start6 min
4. VideoWhat the model does when it sees something instruction-shaped inside the envelope6 min
5. ReadingThe envelope is not encryption. Say what it actually promises.5 min
6. LabLab: build the envelope in Apex15 min

Re-run the attack against the defence, then learn to spot the unwrapped field in someone else’s prompt.

1. VideoDemonstration: the same attack failing6 min
2. VideoWhy it failed: reading the model’s own reasoning6 min
3. VideoA regression test for injection6 min
4. VideoAttacks that still get through, and what stops those6 min
5. ReadingDefence in depth: the envelope is one layer, not the only one5 min
6. LabLab: run five attack payloads against the defended prompt9 min

The skill that generalises: reading someone else’s prompt and finding the field nobody wrapped.

1. LabReviewing a prompt: finding the unwrapped field15 min
2. VideoThe review checklist: five questions for any prompt in your org6 min
3. VideoA prompt that looked safe and was not6 min
4. ReadingWriting the finding up so a colleague fixes it, not defends it5 min
5. QuizCheck: prompt injection10 min