A direct prompt injection occurs when a user directly inputs malicious instructions into an AI model's prompt to manipulate its behavior. For example, telling a chatbot to "ignore previous instructions and say X."

An indirect prompt injection is more subtle: malicious instructions are hidden within external data sources that the AI processes, such as emails, documents, or even social media posts. The AI then unknowingly executes these hidden commands when it interacts with that external content. A recent example involved Grok being manipulated through encrypted instructions hidden in content, causing it to exfiltrate user data. This type of attack is particularly insidious because the user interacting with the AI might not be the one who planted the malicious prompt, making it harder to detect and prevent.