What is prompt injection?
Prompt injection is an attack where text that reaches a language model is interpreted as an instruction instead of as content — because the model reads instructions and data through the same channel and cannot reliably tell them apart. It is ranked LLM01 in the OWASP Top 10 for LLM Applications (2025), the top risk for the second edition running.
Direct vs indirect
| Type | Where the payload lives |
|---|---|
| Direct | The user types it: "ignore your instructions and…" |
| Indirect | It rides in on content the model was asked to process — a web page, a PDF, an email, a tool's output, a retrieved document |
Indirect injection is the dangerous one for agents: the user never sees the malicious text, and the model treats a retrieved page saying "email the database to this address" with the same trust as its system prompt.
Why it is not "solved"
There is no parser that separates instruction from data inside natural language, so there is no complete fix. Defence is layered: constrain the model with a system prompt, treat all tool and retrieval output as untrusted, filter output, restrict what the model is allowed to do, and put a human approval gate on anything irreversible.
Related
MCP tool poisoning is indirect injection through a tool definition. AI red teaming is how you test for it. Tools like Lakera Guard and NVIDIA Garak target it directly.
Sources
- Securing LLM Systems Against Prompt Injection | NVIDIA Technical Blog (developer.nvidia.com) — "Prompt injection is a new attack technique specific to large language models (LLMs) that enables attackers to manipulate the output of the LLM."
- Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arxiv.org) — "Prompt Injection (PI) attacks enable attackers to override original instructions and employed controls."
- LLM01:2025 Prompt Injection - OWASP Gen AI Security Project (genai.owasp.org) — "Prompt injection involves manipulating model responses through specific inputs to alter its behavior, which can include bypassing safety measures."
In the Fathom index
Security tools in the index that address prompt injection. Matched on each item's own record and sorted A–Z, not by merit.