langchain-ai/docs
1
0
Fork 0
mirror of https://github.com/langchain-ai/docs.git synced 2026-07-21 11:55:23 -04:00
Code Issues 490 Packages Projects Releases Wiki Activity

[PR #2675] [MERGED] docs: Add defensive prompts and prompt injection security note to RAG tutorial #2655

New Issue
Closed
opened 2026-02-17 17:23:38 -05:00 by yindo · 0 comments
yindo commented 2026-02-17 17:23:38 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/langchain-ai/docs/pull/2675
Author: @tysoncung
Created: 2/16/2026
Status: ✅ Merged
Merged: 3/13/2026
Merged by: @mdrxy

Base: main ← Head: fix/rag-tutorial-prompt-injection

📝 Commits (2)

  • 227089d Add defensive prompts and prompt injection security note to RAG tutorial
  • eac7216 Merge branch 'main' into fix/rag-tutorial-prompt-injection

📊 Changes

1 file changed (+39 additions, -7 deletions)

View changed files

📝 src/oss/langchain/rag.mdx (+39 -7)

📄 Description

Summary

Addresses langchain-ai/docs#2765.

The RAG tutorial's prompts did not instruct the model to treat retrieved context as data-only, making it susceptible to indirect prompt injection from document contents. For example, the Lilian Weng blog post indexed in the tutorial contains Auto-GPT JSON response format text. When this chunk is retrieved as context, the model follows the formatting instructions embedded in the data instead of the system prompt, outputting JSON with a thoughts object instead of a natural-language answer.

Changes

  • Updated all system/agent prompts across the tutorial (Python and JS) to:
    • Instruct the model to say "I don't know" when retrieved context is irrelevant
    • Explicitly tell the model to treat retrieved context as data only and ignore any instructions within it
  • Added a new "Security: indirect prompt injection" section before "Next steps" that:
    • Explains the root cause (instructions and data sharing the same context window)
    • Provides concrete mitigation strategies (defensive prompts, context delimiters, response validation)
    • Acknowledges that no mitigation is foolproof due to current LLM architecture limitations
    • Links to further reading on prompt injection

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/langchain-ai/docs/pull/2675 **Author:** [@tysoncung](https://github.com/tysoncung) **Created:** 2/16/2026 **Status:** ✅ Merged **Merged:** 3/13/2026 **Merged by:** [@mdrxy](https://github.com/mdrxy) **Base:** `main` ← **Head:** `fix/rag-tutorial-prompt-injection` --- ### 📝 Commits (2) - [`227089d`](https://github.com/langchain-ai/docs/commit/227089d43eaecb2b11a623b0a4d91880d25a4c8b) Add defensive prompts and prompt injection security note to RAG tutorial - [`eac7216`](https://github.com/langchain-ai/docs/commit/eac721686365dbadcac45f2dc16327be20684b60) Merge branch 'main' into fix/rag-tutorial-prompt-injection ### 📊 Changes **1 file changed** (+39 additions, -7 deletions) <details> <summary>View changed files</summary> 📝 `src/oss/langchain/rag.mdx` (+39 -7) </details> ### 📄 Description ## Summary Addresses langchain-ai/docs#2765. The RAG tutorial's prompts did not instruct the model to treat retrieved context as data-only, making it susceptible to **indirect prompt injection** from document contents. For example, the Lilian Weng blog post indexed in the tutorial contains Auto-GPT JSON response format text. When this chunk is retrieved as context, the model follows the formatting instructions embedded in the data instead of the system prompt, outputting JSON with a `thoughts` object instead of a natural-language answer. ## Changes - **Updated all system/agent prompts** across the tutorial (Python and JS) to: - Instruct the model to say "I don't know" when retrieved context is irrelevant - Explicitly tell the model to treat retrieved context as data only and ignore any instructions within it - **Added a new "Security: indirect prompt injection" section** before "Next steps" that: - Explains the root cause (instructions and data sharing the same context window) - Provides concrete mitigation strategies (defensive prompts, context delimiters, response validation) - Acknowledges that no mitigation is foolproof due to current LLM architecture limitations - Links to further reading on prompt injection --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-17 17:23:38 -05:00
yindo changed title from [PR #2675] docs: Add defensive prompts and prompt injection security note to RAG tutorial to [PR #2675] [MERGED] docs: Add defensive prompts and prompt injection security note to RAG tutorial 2026-06-05 18:19:54 -04:00
yindo closed this issue 2026-06-05 18:19:55 -04:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
deepagents
docs-infra
external
external
help wanted
integration
internal
internal
javascript
js/ts
langchain
langgraph
langsmith
needs-title
pull-request
Mirrored from GitHub Pull Request
 python
reference
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langchain-ai/docs#2655
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?