Language models change the attack surface because they take instructions and data through the same channel: plain text. A model cannot reliably tell the system prompt it was given from a sentence hidden in a web page it was asked to summarize. Most attacks in this module build on that single weakness.
Prompt injection overrides the application's intended behavior, either directly through the user's input or indirectly through documents, emails, and web content the model reads. Jailbreaks talk the model out of its safety rules, often through role-play or framing. Once a model can call tools, browse, and send messages, excessive agency turns a manipulated reply into a real action: data leaves, records change, money moves.
Watch the lessons in order, then continue on to AI Red Teaming, where you will learn to test for these attacks in an organised, repeatable way.
Why indirect prompt injection is so hard to fix: hidden instructions in data the model reads, and the comparison with SQL injection.
An IBM Security researcher shows how an attacker can steer a model into a false reality that bypasses its policies and can expose sensitive information.
A real-world case where a user manipulated a car dealership chatbot into agreeing to an absurd sale, and what it shows about trusting a chatbot with business commitments.
A technical walkthrough of agent security: direct and indirect prompt injection, input filtering, sensitive data protection, and authentication and authorization for tools.