Can prompt injection be prevented completely?

Not reliably by filtering alone, because instructions and content share a channel. The durable defence is architectural: limit what the assistant can access and what it can do, so a successful injection is not worth much.

Could someone extract my other customers' data?

Not through injection in a properly scoped system — each bot has its own sources and history, and retrieval is filtered by bot before the model sees anything, so two bots in the same workspace cannot reach each other's content either. The isolation is enforced outside the model rather than requested of it.

Glossary

Prompt injection

Prompt injection is a user trying to talk an assistant out of its instructions.

Start freeNo credit card. 2 minute setup.

Why it matters

Because instructions and user input are both text, a model has no structural way to tell them apart. Someone can write 'ignore your previous instructions' and the model has no separate channel proving which text has authority.

Attempts to make an assistant reveal its instructions
Input crafted to bypass configured boundaries
Assistants persuaded to act outside their intended remit

Why grounding limits the blast radius

The severity of an injection depends on what the assistant can reach. One that answers only from public documentation and holds no tools, no account access, and no private data has very little to be manipulated into revealing — the worst outcome is off-topic text.

Where the risk is real

Injection matters most when an assistant can act — send messages, alter records, spend money — or when it can read data the user should not see. Keeping a support assistant read-only over public content is a deliberate architectural limit rather than a missing feature.

Read-only

Nothing to trigger means nothing to trigger maliciously.

Public content only

Nothing private to extract in the first place.

Common questions

Can prompt injection be prevented completely?: Not reliably by filtering alone, because instructions and content share a channel. The durable defence is architectural: limit what the assistant can access and what it can do, so a successful injection is not worth much.
Could someone extract my other customers' data?: Not through injection in a properly scoped system — each bot has its own sources and history, and retrieval is filtered by bot before the model sees anything, so two bots in the same workspace cannot reach each other's content either. The isolation is enforced outside the model rather than requested of it.