Model template poisoning is tampering with the reusable instructions, prompt template, or agent scaffold that an AI system loads for later use. Unlike a one-off prompt injection, this targets the stored guidance that shapes many future outputs or actions. If an attacker can modify that template, they can steer tool use, change safety behavior, weaken constraints, or make the agent disclose data.
It matters because templates often sit in configuration files, databases, or deployment stores that teams trust more than live user input. In real attacks, poisoning can happen through weak access control, insecure update paths, supply-chain compromise, or abuse of a local service that writes agent settings. Defenses include least-privilege access, signed or versioned templates, integrity checks, separation between user content and system instructions, and monitoring for unexpected template changes. Treat reusable prompts as security-sensitive code, not editable text.