What is prompt injection?

Prompt injection is an attack in which text supplied to a large language model is crafted to override its original instructions. It works because the model can be influenced by instructions in any text it processes, and role separation between system, user and retrieved content is not a hard authorization control.

What is the difference between direct and indirect prompt injection?

In direct prompt injection, the attacker is the user and types the malicious instruction into the chat. In indirect prompt injection, the instruction is hidden in content the AI later reads, such as an email, a web page, a document or a database record, so the attacker never has to interact with the system.

What is the difference between prompt injection and a jailbreak?

The two overlap, and OWASP treats jailbreaking as a form of prompt injection. Jailbreaking attempts to bypass a model's safety constraints. Prompt injection is the broader application-security problem of attacker-controlled instructions influencing model behavior, and its consequences depend on the system's permissions and integrations.

Can prompt injection be fully prevented?

No. Because models can still be influenced by attacker-controlled text, injection cannot be eliminated by filtering or prompting alone. Effective defense limits the damage: least-privilege permissions enforced outside the model, human approval alongside independent authorization for high-impact actions, treating retrieved content as untrusted, security logging, and regular red teaming.

How do you test for prompt injection?

Run adversarial test suites with open-source tools such as Garak or PyRIT against your application, covering both direct and indirect attacks, and repeat the tests after prompt or model changes. For systems connected to sensitive data or tools, add a manual security review of permissions and integrations.