URL-supplied prompts are prompt instructions delivered through a link or URL parameter instead of typed by the user. A web app, browser extension, or AI assistant may read the parameter and preload it into an LLM conversation, search query, or action request. This is useful for sharing workflows, but it also means the prompt comes from an untrusted source unless the system validates it.
In cyber security, this matters because a crafted link can smuggle attacker-controlled instructions into an authenticated session. That can trigger prompt injection, cause an assistant to reveal data the user can already access, or make the system take unintended actions. Defenses include separating data from instructions, rejecting hidden or unexpected prompt fields, sanitizing URL parameters, and requiring clear user confirmation before sensitive actions. Security teams should treat prompt-bearing URLs like hostile input, not as trusted configuration.