Watch: Prompt Injection Exploited, Then Defended

You have the two families of prompt injection and the layers that defend against them. This video shows both ends of the story on one system: a customer-support bot first getting hijacked by an injected instruction, then the same attack bouncing off once defense-in-depth is layered in. Watch the exploit land through the exact channel the last lessons described — the model treating attacker-supplied content as a command — and then watch which layer actually stops it.

Pay attention to where the fix lives. The tempting fix is to argue with the model in the system prompt; the durable fix is architectural — a least-privilege tool that simply cannot issue the refund, and a human gate on the action the attacker wanted. The prompt-level tweaks reduce how often the injection lands; the action-layer controls decide how much it can do when it does. That is the beat the video ends on, and it is the one to carry into the exercise.

What to carry forward

An injection that reaches a model with no dangerous tools and a human gate on irreversible actions is a nuisance, not an incident. Keep the layers ranked by leverage: prompt-level defenses lower the odds, but the action layer — least privilege plus human-in-the-loop — caps the damage. Next you will design that full stack for a support bot, mapping each attack to the layers that defend it.