This one's for anyone who's added an AI chat or assistant feature directly into their own app, not just used an AI tool to build the app itself. That's an increasingly common feature to add, and it comes with everything from the usual checklist plus a shorter, newer list specific to features that read and act on plain-English content.
Scope what the assistant can actually reach
Before anything else, write down, plainly, what data and actions this specific assistant can touch. Can it only see the current user's own information, or does it have broader access for convenience? The narrower its reach, the less any single manipulation attempt can accomplish, regardless of how clever the attempt is.
Separate content from instructions, as much as your tools allow
Anything the assistant reads that came from outside your own system prompt, a user's message, an uploaded file, another user's content, should be treated as data to process, not as instructions to follow. Most AI platforms give you some way to mark content this way. Use it deliberately, rather than concatenating everything into one block of text and hoping the model sorts out which part was meant to be a command.
Gate any real action behind a real confirmation
If the assistant can do something consequential, send an email, issue a refund, delete a record, change a setting, put an explicit confirmation step between the assistant deciding to do it and it actually happening, ideally one a human reviews for anything above a low-stakes threshold. An assistant that can only suggest an action is a very different risk than one that can silently execute it.
Rate-limit the AI feature itself, not just your login form
AI API calls usually cost real money per request. A chat feature with no rate limit is an open invitation for someone to run your usage bill up by hammering it with requests, independent of anything related to prompt injection specifically. Apply the same kind of limit here you'd apply to a login form.
Test it like someone trying to misuse it, not like a user asking a normal question
- Try embedding an instruction inside content the assistant is meant to summarize or process, and see whether it follows that instruction instead of treating it as plain text.
- Ask the assistant directly for information it shouldn't have access to, and confirm it actually refuses rather than politely providing it.
- Check what happens if you send an extremely long or unusual input. Does the feature handle it gracefully, or does something break in a way that reveals more than it should.
Everything from the older checklists on this blog still applies underneath this: the database still needs its access rules, the API routes still need their auth checks. An AI feature doesn't replace any of that. It just adds one more layer, with its own specific new question sitting on top: what happens when the content it reads was written by someone trying to steer it somewhere it shouldn't go.