Prompt injection is an attack where adversary-controlled text is fed to a large language model (LLM) to override its intended instructions, making the model ignore its rules, leak data, or take actions the developer never authorized. OWASP ranks it as LLM01, the number one risk in its Top 10 for LLM Applications, because it targets the core design of these systems: an LLM cannot reliably tell the difference between the trusted instructions its developer wrote and untrusted text that arrives in its input.

Understanding what is prompt injection matters more every month, as LLMs move from chatbots into agents that browse the web, read email, and call tools. When a model can act, a successful injection stops being a curiosity and becomes a path to data theft or unauthorized actions. The attack surface now spans the model, its system prompt, retrieved documents, web pages, and connected tools like Model Context Protocol (MCP) servers.

What is the difference between direct and indirect prompt injection?

Direct prompt injection is when the user typing to the model is the attacker, entering text like "ignore your previous instructions" to jailbreak it. Indirect prompt injection is more dangerous: the malicious instructions are hidden in content the model later reads, such as a web page, a PDF, a support ticket, or a code comment, so the victim is a normal user whose agent processes attacker-planted text.

Indirect injection is what makes AI agents genuinely risky. In August 2026, researchers showed an NVIDIA NemoClaw weakness where a malicious web page could poison a local model's chat template so hidden instructions applied to every later conversation, and separate work has repeatedly shown hidden text in documents and MCP tool descriptions steering agents into exfiltrating secrets. The pattern is always the same: trusted-looking content carries an untrusted instruction the model dutifully follows.

Why is prompt injection so hard to fix?

Because the vulnerability is architectural, not a bug in one line of code. LLMs process instructions and data through the same channel, so there is no clean boundary to enforce the way input validation stops SQL injection. As NIST notes in its AI guidance, adversarial manipulation of model inputs is a persistent risk class rather than a single patchable defect. Filters and system-prompt hardening raise the bar but do not close it, which is why defense in depth is the accepted approach.

How do you defend against prompt injection?

Treat the model as untrusted and constrain what it can do. The durable defenses are architectural: give the agent least privilege so a hijacked model cannot reach sensitive tools or data, require human approval for high-impact actions like sending email or moving money, isolate untrusted content, and log and monitor agent actions so anomalies surface. Input and output filtering help as additional layers, but should never be the only control.

Frequently asked questions

Is prompt injection the same as jailbreaking? They overlap. Jailbreaking specifically means bypassing a model's safety guardrails; prompt injection is the broader class of overriding intended instructions, which includes jailbreaks and indirect attacks through external content.

Can prompt injection steal data? Yes. If an agent has access to files, email, or databases, an indirect injection can instruct it to read and exfiltrate that data, which is why least privilege matters so much.

Does prompt injection have a CVE? Usually not, because it is a design-level weakness rather than a discrete software flaw, though specific injectable products sometimes receive CVEs.

Our read

Prompt injection is the defining security problem of the agent era, and the honest framing is that you manage it rather than eliminate it. That mirrors how we think about supervised adversary simulation: assume the model can be turned against you, then verify what an attacker could actually reach and do once it is. The useful question for any AI feature is not "can we block every injection" but "if this agent is hijacked tomorrow, what is the blast radius, and have we tested it?" Answer that before you ship the tool access, not after.

Risk ranking per OWASP GenAI; adversarial-input framing per NIST. Sources linked above.

Related: What is LLM penetration testing? and AI agent security risks in 2026.