What is prompt injection?
Prompt injection is an attack where text that reaches a language model is interpreted as an instruction instead of as content — because the model reads instructions and data through the same channel and cannot reliably tell them apart. It is ranked LLM01 in the OWASP Top 10 for LLM Applications (2025), the top risk for the second edition running.
Direct vs indirect
| Type | Where the payload lives |
|---|---|
| Direct | The user types it: "ignore your instructions and…" |
| Indirect | It rides in on content the model was asked to process — a web page, a PDF, an email, a tool's output, a retrieved document |
Indirect injection is the dangerous one for agents: the user never sees the malicious text, and the model treats a retrieved page saying "email the database to this address" with the same trust as its system prompt.
Why it is not "solved"
There is no parser that separates instruction from data inside natural language, so there is no complete fix. Defence is layered: constrain the model with a system prompt, treat all tool and retrieval output as untrusted, filter output, restrict what the model is allowed to do, and put a human approval gate on anything irreversible.
Related
MCP tool poisoning is indirect injection through a tool definition. AI red teaming is how you test for it. Tools like Lakera Guard and NVIDIA Garak target it directly.