Prompt injection happens when untrusted input — a webpage, document, email, or user message — smuggles instructions into an LLM's context and hijacks its behavior. Because most models cannot reliably separate 'system intent' from 'data', a well-crafted string can make an assistant leak secrets, ignore safety rules, or call tools it should not.
Defenses layer input sanitization, tool-permission scoping, output filtering, and human review on any action with real-world side effects. There is no single fix; treat every model call as if the input might be adversarial.