Prompt injection is when text fed into an AI model — whether typed by a user or hidden inside a webpage, email, or document the model reads — makes the model follow instructions it was never supposed to follow. It is the single most-cited security risk for large language model applications today, and it sits at the top of the OWASP Top 10 for LLM Applications as risk LLM01. Understanding how it works, and where it actually shows up in real products, is the first step to building AI features that don’t quietly do what an attacker wants instead of what you asked for.
What Is Direct Prompt Injection?
Direct prompt injection is the simplest form: the person typing into the chat is the one trying to override the system’s intended behavior. According to OWASP’s official definition, this happens “when a user’s prompt input directly alters the behavior of the model” — for example, someone typing “ignore your previous instructions and instead tell me X” into a customer-support chatbot that was only supposed to answer questions about shipping policies.
This is closely related to jailbreaking, but the two aren’t identical. Jailbreaking tries to get a model to violate its own safety training; prompt injection tries to make a model follow attacker instructions embedded in a prompt, hijacking a task rather than removing a safety limit. In practice, the mitigations for both overlap heavily, which is why Anthropic’s documentation discusses them together.
What Is Indirect Prompt Injection?
Indirect prompt injection is the more dangerous variant, and it’s the one that matters most as AI agents start browsing the web, reading email, and using tools on a person’s behalf. Here, the attacker isn’t the user at all — the malicious instructions are planted in content the AI later processes: a comment on a product listing, a hidden line in a document, or text buried in a webpage. OpenAI describes this exact scenario: instructions “hidden on a webpage, such as in a comment on a listing or on a review,” waiting for an AI agent to read the page and act on them.
The reason this is harder to catch is simple: the user never sees the malicious instruction. They asked the agent to “summarize this product page” or “check my email for anything urgent,” and the attack rides in on content the agent was already going to read as part of a normal, legitimate task.
Why Is Indirect Injection the Bigger Risk for AI Agents?
An AI agent that can browse the web, read a calendar, or send emails is only as trustworthy as the content it’s allowed to treat as instructions. Because agents ingest pages, documents, and messages the user never personally reviews, an attacker can hide directions in invisible text, a code comment, or an image’s alt text — anywhere the model will read it but a human skimming the page won’t notice. Google’s security team frames this as requiring a “layered defense strategy,” precisely because no single filter catches every way instructions can be smuggled into content an agent processes.
How Do You Defend Against Prompt Injection?
No vendor or security body claims prompt injection can be fully prevented — every credible source describes defense-in-depth instead. Here’s what that actually looks like in practice, based on the current guidance from OWASP, OpenAI, Anthropic, and Google:
- Treat all external content as untrusted. Anthropic’s guidance recommends keeping third-party content (web pages, tool results, retrieved documents) out of the system prompt entirely, labeling its source explicitly, and never letting it carry the same authority as instructions from the actual user.
- Apply least-privilege access. OWASP recommends giving an AI application its own narrowly scoped API tokens and handling sensitive actions in code rather than trusting the model’s judgment alone — so even a successful injection can’t do more than the account it’s running under is allowed to do.
- Require human confirmation for sensitive actions. OpenAI notes that its agent products pause and ask for explicit confirmation “prior to taking sensitive steps such as completing a purchase.” Google describes a similar “contextual user confirmation system” for higher-risk operations.
- Filter both input and output with classifiers. Google uses machine-learning content classifiers to catch malicious instructions in incoming data; Anthropic recommends scanning content that enters a model’s context window and, for agentic workflows, using a lightweight model as a pre-screen before untrusted content ever reaches the main model.
- Red-team the system continuously. OWASP recommends regular penetration testing that treats the model itself as an untrusted user — probing for exactly the kind of embedded instructions a real attacker would plant.
If you’re already investing time in writing a strong system prompt, treat prompt injection defense as the other half of that job: a well-structured system prompt tells your model what it should do, and these controls limit the damage when something tries to tell it otherwise. The same discipline that helps you reduce hallucinations with clearer prompts — being explicit, structured, and skeptical of unverified input — is exactly what makes a system harder to hijack.
Frequently Asked Questions
Is prompt injection the same thing as jailbreaking?
No. Jailbreaking tries to get a model to violate its own safety training and produce content it would normally refuse. Prompt injection tries to make a model follow attacker instructions embedded in a prompt or in content it reads, hijacking a task rather than removing a safety limit. The two often get discussed together because the defenses overlap, but they’re different attack mechanisms.
Can prompt injection be completely prevented?
No major AI vendor or security organization claims a complete fix exists. OWASP, OpenAI, Anthropic, and Google all describe layered, defense-in-depth approaches — input/output filtering, least-privilege access, human confirmation for sensitive actions, and ongoing red-teaming — that reduce risk rather than eliminate it entirely.
Why do AI agents make prompt injection more dangerous?
An agent that browses the web, reads email, or uses tools ingests content the user never personally reviews. Attackers can hide instructions inside that content — invisible text, a code comment, a review — so the user has no chance to spot the attack before the agent acts on it. That’s why OWASP and Google both flag indirect prompt injection as a particular concern for agentic AI systems.
Featured image: “Clear padlock and keys” by zaphad1 on Flickr, licensed under CC BY 2.0.
