Prompt Injection
Definition
Prompt injection is an attack where injected inputs cause a language model to bypass original instructions and protective rules.
In prompt injection, inputs alter the behavior or output of a language model in unintended ways. This can happen directly via user inputs or indirectly via external sources such as websites or files. Possible consequences include violated policies, harmful content, unauthorized access, or influenced decisions; type and severity depend on the context of use and the model's scope of action.
Simply explained
A hidden instruction in a document tries to distract the AI from its original task.
Why it matters in practice
Anyone letting AI assistants work with websites or files must expect that foreign content may contain instructions for the model.
Example from business
Possible example: A found website asks the agent for a foreign tool call; the application ignores this.
Limits and pitfalls
- Foreign content must not be considered trusted instructions. RAG and fine-tuning do not fully eliminate prompt injection; model permissions should be limited and risky actions require human approval.
Origin & history
Greshake and co-authors described indirect prompt injection attacks via retrieved content in LLM applications in 2023. This work is a documented research reference, not a statement about the first use of the term. In the OWASP project, prompt injection appears as LLM01 in the LLM Top 10 in the 2025 edition.
Use in mid-sized companies
- Possible application: An operation grants a research agent read-only access and requires human approval for actions with external effects, such as sending an email.
Frequently asked questions
Is prompt injection the same as jailbreaking?
OWASP describes jailbreaking as a form of prompt injection intended to override security rules.
Does this only affect chats?
No, hidden instructions can also arrive via websites or files.
Can the attack be reliably prevented?
Complete prevention is not guaranteed; countermeasures mainly aim to limit impact.
Sources
- Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection · Greshake et al. (2023): Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
- LLM01:2025 Prompt Injection · OWASP Gen AI Security Project (2025): LLM01:2025 Prompt Injection
Sources checked on 14.10.2026. Editorial application examples are hypothetical; no proof of real customer results.
Editorially reviewed on: