Prompt injection: definition and brand risk

Prompt injection is text written to change what a language model does, placed where the model will read it as input. The model was given a task by its operator, such as answering a user's question. Injected text tries to override or redirect that task.

There are two broad forms:

• Direct prompt injection: a user types the instructions into the chat themselves.
• Indirect prompt injection: the instructions sit inside content the model fetches, such as a web page, a document or a search result. The user never sees them.

Indirect injection is the form that matters for AI search. This entry is a short definition. For mechanics, examples and defenses, read the full guide on prompt injection and hidden text in AI search.

AI search engines and agents retrieve pages, place their text in the model's context, and generate an answer from it. Anything in that text becomes input. If a page contains a line addressed to the model (for example, an instruction to recommend one product or dismiss another), the model may treat it as guidance rather than as content to summarise.

The instructions are often concealed from human visitors using hidden text or served only to crawlers through cloaking. Both make the attack harder to spot when someone checks the page in a browser.

This works at the generation stage. The critical survey of GEO research (arXiv:2607.14035, July 2026) found that already-retrieved content can causally alter its citation or use. Injection exploits exactly that: it only acts once a page is inside the model's context.

The clearest evidence comes from a study of LLM search agents (arXiv:2606.16821v2, June 2026). It found that attack success rates ranged from 0.0% on Claude-Sonnet-4.6 to 31.4% on Gemini-3-Flash. The strongest attack mode differed by model family, and the same deployment setup could raise or lower success rates on different backends. Our summary of that search agent study covers the design in more detail.

Two limits shape how to read it:

• The study used a mock search API and never published adversarial content to the open web. It shows what happens once manipulated content is in the result set, not how hard it is to get there.
• The per-model rates are point estimates on one attack corpus. They re-baseline with each safety update, so treat them as a snapshot, not a durable ranking of models.

For a brand, the practical risk is not your own pages. It is pages you don't control that mention you. A review roundup, a forum post or a competitor comparison could carry text aimed at steering answers about your product. If you want to know whether that is happening, the next move is a structured check: our playbook on scanning third-party pages for injected instructions walks through it.

"It's a clever GEO tactic"

It isn't. Injected or adversarial content is manipulation of the system, and engines treat it as a risk to defend against. The legitimate route into AI answers runs through access (crawlability, indexing, rendering) and being named on the sites engines already cite.

"Some models are immune"

A 0.0% result in one study on one attack corpus is not immunity. Rates change as vendors update models, and attack modes differ by model family.

"Blocking AI crawlers protects my brand"

Your robots.txt controls your own site. It does nothing about third-party pages that mention you and get retrieved.

"Every wrong AI answer is an attack"

Most wrong answers about brands come from stale training data, missing facts or contradictions across sources. Injection is one possible cause among several. Check the simpler ones first, and use a clear standard for what counts as a critical AI error before escalating.

• Hidden text: content concealed from visitors, a common carrier for injected instructions.
• Cloaking: serving different content to crawlers than to people.
• Can a competitor manipulate what AI says about my brand?: the brand-level version of this risk.
• Indirect prompt injection: instructions delivered through retrieved content rather than typed by the user.
• AI content manipulation: the broader category of attempts to distort what generative engines say, of which injection is one form.

What is indirect prompt injection? Indirect prompt injection is when instructions for a model are planted in content the model retrieves, such as a web page or document, rather than typed by the user. The user asking the question never sees the instructions. In AI search, this means any page an engine fetches could, in principle, try to steer the answer it helps produce.

Can prompt injection make an AI say false things about my brand? It can try. Research on LLM search agents shows that manipulated content already in the result set can change what agents endorse, with success varying widely by model. As of October 2026, no study has measured how often this happens to real brands on the live web. Treat it as a risk to check for, not a confirmed cause of a specific wrong answer.

Should I add instructions for AI to my own pages? No. Planting instructions aimed at models is manipulation, and it carries risk without any evidence of durable benefit. If you want engines to describe you correctly, state specific facts (prices, product names, a one-line definition) plainly in HTML that crawlers can fetch. That gives an engine a sentence it can quote without trying to steer it.

How would I know if a third-party page is targeting my brand? Start with the pages that rank or get cited for questions about your category. Inspect their raw HTML, not just the rendered page, for text addressed to models, hidden blocks or content that differs between browser and crawler views. Repeat the check periodically, because pages change and so do the models reading them.