Prompt Injection

What Is Prompt Injection?

Prompt injection happens when an attacker crafts input specifically designed to override a model's original instructions and get it to follow theirs instead. The term was coined in 2022, and by the time OWASP published its LLM Top 10, it had already become the risk practitioners were most worried about, a spot it still holds. It becomes significantly more dangerous once an LLM is connected to other systems, tools, or agents: a successful injection can be the entry point to data exfiltration, unauthorized actions, or remote code execution.

How It Works

Direct injection — typed straight into the prompt, e.g., "ignore your previous instructions and instead..."
Indirect injection — hidden in external content the model reads. See Indirect Prompt Injection.
Visual injection — hidden inside an image rather than text. See Visual Prompt Injection.
Agentic prompt injection — targets an AI agent specifically, aiming not just to change what the model says but to get it to take a real action: calling a tool, executing a transaction, or reaching into a connected system it shouldn't. Delivery can still be direct, indirect, or visual, what makes it "agentic" is that the payoff is an action, not just a bad response.
Why it's hard to block — LLMs accept unstructured natural language, so the space of possible attacks is effectively unbounded.

FAQ

No, jailbreaking is a category of prompt injection focused specifically on defeating safety training, not hijacking for a specific action. See Jailbreak.

A single filter or blocklist won't catch every variant, since LLMs process open-ended natural language rather than fixed patterns. But a properly built, multi-layered defense, one designed specifically for the non-deterministic nature of LLMs rather than adapted from traditional security tooling, can reliably block prompt injection attempts, including ones that haven't been seen before.

Share this page

Related Terms

Indirect Prompt Injection

Indirect prompt injection happens when an LLM or agent processes attacker-controlled content from an external source, like a webpage or document, rather than a direct user input.

Visual Prompt Injection

In a visual prompt injection, malicious instructions are hidden inside an image rather than the text prompt, designed to be read by the model but invisible to the person looking at it.

Jailbreak

Jailbreaking is a category of prompt injection focused on getting a model to ignore its safety training and guardrails rather than hijacking it for a specific downstream action.

Insecure Plugin Design

LLMs and agents calling external tools, whether through legacy plugins, function calling, or MCP servers, can be manipulated into making malicious requests to those tools if inputs aren't properly validated.

Prompt Injection 101

The Agentic AI Attack Surface: Where Risk Lives Beyond the Prompt

Why AI Browsers Create a New, Unavoidable Security Risk

ps-fuzz

Demo: Stateful Protection for Homegrown AI Apps

Is prompt injection the same as jailbreaking?

Can prompt injection be fully prevented?

Related Resources

Prompt Injection 101

The Agentic AI Attack Surface: Where Risk Lives Beyond the Prompt

Why AI Browsers Create a New, Unavoidable Security Risk

ps-fuzz

Demo: Stateful Protection for Homegrown AI Apps