AI Prompts Are Code Now. Treat Them Like It.
When you send user data to an AI API, you're not just storing it—you're executing it as instructions. I learned this the hard way.
Last year I built a Telegram bot that summarized user documents through Claude. Seemed straightforward: user uploads PDF → extract text → send to AI → return summary.
First version? I just piped the raw text into the prompt. No sanitization, no boundaries. Took about three days before someone found out they could inject instructions into their document that would make the bot leak other users' summaries.
That's when it clicked: an AI prompt isn't a storage operation. It's code execution.
When you call Claude.messages.create({ messages: userInput }), that string isn't data anymore. It's an instruction the model will interpret and follow. The model has no concept of what's "supposed" to be user content versus "supposed" to be your logic. It just sees tokens.
Here's what I do now:
Separate concerns explicitly. I build prompts with hard boundaries. System prompt defines the role. User input goes into a separate message block, clearly labeled as such. The model still sees it all, but the structure makes injection attacks obvious.
Never trust output. Whatever the AI returns could be crafted by a hostile actor's prompt injection. If it's sensitive (financial numbers, user IDs, anything production-critical), validate it server-side like you would any untrusted input.
Log everything. Before sending to the API, I log the exact prompt structure. Not the response—that's usually fine. The prompt is what matters. If something goes wrong, I can audit what instruction actually reached the model.
Rate limit aggressively. This isn't just about DoS. It's about limiting the damage if someone finds an injection vector. Three requests per user per hour for summaries. Stops the bleeding while you patch.
Test injection. Seriously. Add a test case where user input contains prompt injection attempts. See what your system does. Most frameworks make this trivial to add.
I've since built similar AI features into Seven Suite and custom ERPNext modules. The pattern holds: assume the prompt is hostile, structure it defensively, validate the output.
AI is powerful. It's also trusting. Don't be naive about it.