Can someone poison ChatGPT?

Poisoning a major model's training is hard and slow. It is easier to poison the documents or web pages a specific AI tool reads, which is why your own sources matter.

How do I protect a company chatbot from poisoned data?

Control who can change its documents, review updates before publishing, and test it with known questions after each change.

Is data poisoning common?

Large attacks on major models are rare and hard. Misleading content on the web and in shared documents is common, and AI tools can pick it up.

What is data poisoning in AI?

AI basics AI glossary

Quick answer

Data poisoning is an attack where someone slips bad, misleading or rigged content into the data an AI system learns from or looks things up in. The aim is to make the model give wrong answers, show a bias, or behave a certain way when it sees a trigger, long after the bad data went in.

Last updated October 20, 2026

Take the free module →Module 3 of the free AI Security for Small Business course, about 6 minutes. No account needed.

Updated October 20, 2026 · By Robert Breen

Why it matters for a small business

For the big model makers, the risk is in training data scraped from the web. For a business, the closer risk is your own knowledge base and files: a shared drive anyone can edit, a scraped web page, or a supplier document that your chatbot or agent treats as fact.

The defenses are ordinary data hygiene. Know who can add or change the documents your AI reads, keep sources you control, and review changes before they go live.

Poisoning can also be subtle. A planted line in a supplier page that says a competitor's product was recalled, or a fake review, may sit unnoticed until an AI tool repeats it as fact.

In a real lesson: Catch a Poisoned Email Before Your AI Assistant Obeys It using Claude

Catch a Poisoned Email Before Your AI Assistant Obeys It calls the Brightpath Supplies email "poisoned", but the attack it teaches is prompt injection: a hidden line in one email trying to give the AI orders right now. The lesson keeps that distinction clear.

Data poisoning is the slower cousin. If that same vendor text were added to a knowledge base your assistant searches every day, it could mislead every future answer, not just one summary. The lesson's habits still apply: treat outside text as data, never orders, and keep a person approving.

Try this lesson free or read the step-by-step guide.

Common confusions

Data poisoning vs prompt injection

Prompt injection hides orders in text the AI reads now. Data poisoning corrupts the data it learns from or retrieves later.

Data poisoning vs hallucination

A hallucination is the model inventing something. Poisoning is a person planting the wrong thing on purpose.

Tips

Limit who can edit the files your chatbot or agent reads.
Prefer sources you control over scraped pages.
Re-test key questions after documents change.

Prompt injection Training data Knowledge base Retrieval-augmented generation (RAG)Least privilege

More AI basics terms

Deep learning Deepfake Diffusion model Embeddings

Where you use it: free lessons

Catch a Poisoned Email Before Your AI Assistant Obeys It using Claude (Claude, 6 min)
Give Your Voice Agent Knowledge: A Price List and FAQ in ElevenLabs (ElevenLabs Agents, 9 min)

Frequently asked questions

Can someone poison ChatGPT?: Poisoning a major model's training is hard and slow. It is easier to poison the documents or web pages a specific AI tool reads, which is why your own sources matter.
How do I protect a company chatbot from poisoned data?: Control who can change its documents, review updates before publishing, and test it with known questions after each change.
Is data poisoning common?: Large attacks on major models are rare and hard. Misleading content on the web and in shared documents is common, and AI tools can pick it up.

All AI glossary terms, A to Z · Free prompt templates