What Is Prompt Injection?
Prompt injection happens when an attacker crafts input specifically designed to override a model's original instructions and get it to follow theirs instead. The term was coined in 2022, and by the time OWASP published its LLM Top 10, it had already become the risk practitioners were most worried about, a spot it still holds. It becomes significantly more dangerous once an LLM is connected to other systems, tools, or agents: a successful injection can be the entry point to data exfiltration, unauthorized actions, or remote code execution.
How It Works
- Direct injection — typed straight into the prompt, e.g., "ignore your previous instructions and instead..."
- Indirect injection — hidden in external content the model reads. See Indirect Prompt Injection.
- Visual injection — hidden inside an image rather than text. See Visual Prompt Injection.
- Agentic prompt injection — targets an AI agent specifically, aiming not just to change what the model says but to get it to take a real action: calling a tool, executing a transaction, or reaching into a connected system it shouldn't. Delivery can still be direct, indirect, or visual, what makes it "agentic" is that the payoff is an action, not just a bad response.
- Why it's hard to block — LLMs accept unstructured natural language, so the space of possible attacks is effectively unbounded.
