Prompt Injection in Clinical Artificial Intelligence Systems: The Emerging Security Challenge of Large Language Models and Agentic AI.

Abstract

Clinical discussion of artificial intelligence safety has concentrated on accuracy, bias, and hallucination, each of which describes a model failing at its assigned task. Prompt injection describes the opposite condition: a model performing exactly as instructed, by an instruction the clinician neither wrote nor can see. The vulnerability arises from a fundamental property of current language-model architectures, which receive an undifferentiated stream of tokens and possess no mechanism for distinguishing content that carries authority from content that does not. Medicine is particularly exposed, because the clinical record is assembled from material originating outside the institution, including referral correspondence, patient-entered messages, external reports, scanned documents, and imaging acquired elsewhere. We argue that prompt injection warrants classification as a patient safety hazard with an articulated threat model rather than as a technical curiosity, that improved prompting and input filtering do not address it, and that the workable response lies in provenance-aware context handling, restricted privileges for irreversible actions, and adversarial testing before deployment.