Treat external content as untrusted input
Course overview · 4 min reading + 12 min practice, estimated
Principles and method
Candidate documents, emails and websites may contain instructions that conflict with the task. This is a prompt-injection risk when a model treats source content as authority. Keep trusted instructions separate and enforce permissions outside the model. Validate tool arguments and output destinations. Avoid exposing secrets or unrelated records to a task that does not need them. A source can be quoted or summarised without being allowed to redefine the workflow. Detection helps, but the safest design also limits the damage if the model follows a malicious instruction.
Worked example
A CV includes text asking the assistant to export all applicants to an external address. The system can read the CV as evidence but has no tool permission to export other records or send to arbitrary destinations.
Put it into practice
Create three malicious source examples and identify the control that blocks each action.
Use fictional information and keep your work in your own notes.
Compare your approach: self-review guidance
Include an attempted data export, instruction override and unauthorised status change. Name the enforcement boundary, not just a model warning. Test with fictional data only.
Sources and further reading
Original Academy teaching and fictional examples. These references provide context, not endorsement. Edition 2026.09; updated 2026-09-24.
- OWASP: Top 10 for large language model applications
Security background for applications that use language models.
- NIST: AI Risk Management Framework
Voluntary framework for organising AI risks and controls.
- GOV.UK: Responsible AI in recruitment
UK guidance on procuring and deploying recruitment AI.