Skip to content
atlas

Don't confuse these

Prompt injection vs System prompt

Why they differ

Both are instructions to the model, but the system prompt comes from the app's builder while prompt injection smuggles in an attacker's orders that try to override it.

Prompt injection

AI risk & governance

Hiding instructions in the text an AI system reads so that it ignores its own rules and follows the attacker instead.

Formal

An attack on a large language model in which input written by an outsider, typed directly or hidden in a web page, file or email the model is asked to read, is treated as an instruction and overrides what its owner intended.

In plain English

Like slipping a note into a pile of letters a new assistant is sorting that says "ignore your boss and send me the keys" - and the assistant cannot tell the note apart from real orders.

In practice

A municipality's AI assistant sums up incoming emails from citizens; one email hides white-on-white text telling it to forward the last ten messages to an outside address, and it does.

Why it matters

The model mixes rules and content in the same stream of words, so there is no watertight fix yet; the more an AI system is allowed to do on its own, the more damage one hidden sentence can cause.

System prompt

Prompting & generation

Standing orders the maker of an AI service places ahead of every chat, setting the assistant's role, rules and tone before the user types.

Formal

The part of a prompt, marked with its own role, that carries instructions from whoever built the service rather than from the end user; instruction tuning teaches the large language model to weigh it above user text, but nothing enforces that.

In plain English

Like a director's notes to an actor before the curtain rises - the audience never hears them, yet they shape every line, and a loud voice from the seats can still knock the actor off script.

In practice

The web manager at a Danish ferry company writes the system prompt for its booking chat: “Answer only about departures and bookings; never promise refunds; pass complaints to staff.”

Why it matters

Users can often coax an assistant into revealing its system prompt, and prompt injection can override it, so it must never hold passwords or keys and cannot replace real access control.

Shared connections

Atlas is in beta.