Prompt Injection Explained
Prompt injection is the defining vulnerability of AI applications: untrusted input making a model follow instructions it should not. This guide explains how it works and how it is tested.
Why it exists
An LLM cannot reliably tell the difference between instructions from its developer and instructions inside the content it is processing, because both arrive as text in the same context. That is the whole vulnerability.
Direct vs indirect
| Direct | Indirect | |
|---|---|---|
| Who plants it | The attacker types it | Hidden in content the model reads |
| Example | A malicious chat message | A poisoned document or web page |
| Victim | The attacker's own session | A legitimate user's session |
Indirect injection is the dangerous one, because the victim did nothing wrong. Full detail in prompt injection explained.
What does not work as a defence
- Telling the model to ignore injections, that is just more text
- Keyword filtering, trivially bypassed
- A bigger model, every frontier model is injectable
The framing that matters: impact follows capability. A model that can only chat is low risk. A model that can call tools or read private data turns injection into real damage.
How it is tested
Map the model's capabilities first, then attempt direct injection, then plant indirect payloads in every content path, then chase exfiltration and unauthorised action. Methodology in LLM red teaming.
Related
Frequently asked questions
What is prompt injection?
Untrusted input making a language model follow instructions it should not, because it cannot separate instructions from data.
What is indirect prompt injection?
A payload hidden in content the model reads later, like a document or web page, that executes in a legitimate user's session.
Can prompt injection be prevented?
Not fully. Defence focuses on limiting what a successful injection can achieve, mainly by restricting model capability.
Is prompt injection a real risk?
It depends on capability. Text only output is low risk. A model with tools or private data access makes it serious.
How do I test for prompt injection?
Map the model's capabilities, attempt direct and indirect injection, then measure whether you can exfiltrate data or trigger actions.