Prompt injection explained: attacks and defences
Prompt injection is when text given to a language model changes what it does in a way its builder did not intend. This guide explains direct and indirect injection, what attackers can gain, and the defences OWASP recommends, with the limits of each. It follows on from system prompts and sits in prompting and AI workflows.
By the Chelure Enterprises Editorial Team. Last reviewed . How we check our sources.
The problem in one sentence
A language model receives instructions and data as the same kind of thing, text. Greshake and colleagues (2023) put it as LLM-integrated applications blurring the line between data and instructions, so text the model retrieves can act as commands. OWASP lists prompt injection as the first risk (LLM01) in its Top 10 for LLM applications.
Direct and indirect injection
| Type | How it works | Example |
|---|---|---|
| Direct | The user's own prompt alters the model's behaviour, deliberately by an attacker or accidentally | A user types a message telling a support bot to ignore its rules |
| Indirect | The model ingests outside content (websites, files, emails) that contains hidden instructions | A web page the assistant is asked to summarise contains hidden text telling it to send the user's data elsewhere |
Indirect injection is the harder case, because the attacker does not need access to your application: they only need to plant text where it will be retrieved. Greshake et al. demonstrated such attacks against Bing's GPT-4-powered chat and code-completion engines and against synthetic GPT-4 applications, and described impacts such as data theft and the spread of injected prompts between systems.
What is at stake
OWASP lists these impacts: leaking sensitive information, including details of the system prompt or infrastructure; biased or manipulated output; unauthorized use of the model's functions; running commands in connected systems; and corrupting critical decisions. The risk grows with what the model is allowed to do, which is why a chatbot that only answers questions is far less exposed than an agent that can send email or run code.
Defences and their limits
| Defence (OWASP) | What it does | Limit |
|---|---|---|
| Constrain the model's role and limits in the system prompt | Narrows what it will attempt | Text instructions can be overridden by other text |
| Require defined output formats and validate them with deterministic code | Rejects malformed or unexpected output | Only catches what the format can express |
| Filter inputs and outputs (semantic and string-based checks) | Blocks known bad patterns | Attackers rephrase; imperceptible or encoded input is hard to filter |
| Least privilege: keep tool credentials and execution in application code | Limits what a hijacked model can do | Does not stop wrong answers |
| Human approval for high-risk actions | Stops irreversible damage | Slows the workflow; approvers can be fooled by plausible output |
| Clearly label untrusted external content | Helps the model separate data from instructions | A hint to the model, not enforcement |
| Regular adversarial testing, treating the model as an untrusted user | Finds weaknesses before attackers do | Never complete |
Anthropic's prompting guide recommends wrapping different kinds of content in their own tags (for example separate tags for instructions, context and input) so the model can parse them unambiguously. That helps the model, but as OWASP notes, no measure is a fool-proof prevention, so design on the assumption that the model can be tricked and make sure the consequences are small.
A practical checklist
- List everything the model can do (tools, files, network) and remove what it does not need.
- Never place secrets or credentials in the prompt.
- Validate model output before you act on it.
- Ask a person to confirm anything irreversible.
- Log prompts and outputs so you can investigate incidents, and keep our token counter habit for sizing what you log: untrusted pages can be very long.
Frequently asked questions
What is prompt injection?
OWASP defines a prompt injection vulnerability as one that occurs when user prompts alter the model's behaviour or output in unintended ways. The injected input can even be imperceptible to humans, as long as the model parses it.
What is the difference between direct and indirect prompt injection?
In direct injection, the user's own prompt changes the model's behaviour. In indirect injection, the model ingests outside material such as a website or file that contains hidden instructions which then steer it.
Can prompt injection be fully prevented?
OWASP says no fool-proof prevention is known, so its measures aim to reduce impact. Treat the model as an untrusted component and limit what it can do.
What can an attacker achieve?
OWASP lists leaking sensitive information including system prompt details, manipulated output, unauthorized use of the model's functions, running commands in connected systems and corrupting critical decisions.
Does telling the model to ignore malicious text work?
It helps a little but is not a control. Instructions in a system prompt and data from outside both reach the model as text, which is the core problem the research describes: such applications blur the line between data and instructions.
Is this a bigger risk for agents?
Yes, because agents with tools can act on injected instructions. OWASP recommends least privilege, keeping tool credentials and execution in application code, and requiring human approval for high-risk actions.
Sources
- OWASP: LLM01 Prompt Injection (Top 10 for LLM applications)
- Greshake et al.: Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv:2302.12173)
- Anthropic: prompting best practices (structuring content with tags)
- OpenAI: prompt engineering guide (message roles)
Primary sources opened on November 13, 2026. Prices come from our verified price table (see the methodology).