Prompt injection is manipulating a large language model's behaviour through crafted input or through external content it ingests. It is LLM01, the number-one risk in the OWASP LLM Top 10, and it is considered largely unsolved because models process instructions and data in the same channel — there is no reliable separation between trusted commands and untrusted content. It comes in two forms: direct (jailbreaking, where the user overrides behaviour) and indirect (hidden instructions in a web page, document or email the model reads). Testing runs adversarial prompting and jailbreak batteries for the direct case, and plants hidden instructions in ingested content for the indirect case, checking whether the model obeys and whether data can be exfiltrated. Mitigations reduce but never eliminate the risk — treat the model as an untrusted user.
// 01 What is prompt injection?
Prompt injection is the manipulation of a large language model so that it behaves in ways its designers did not intend — ignoring its guardrails, revealing information it should protect, or taking actions it should refuse. The manipulation can come from the user directly, or from content the model reads as part of its task. A defining and uncomfortable property is that the malicious content only needs to be parseable by the model, not human-readable: instructions hidden in white-on-white text, inside an image, or split across a document can all steer a model, which is why the attack surface is so large.
OWASP ranks it as the top risk in LLM applications, and it is genuinely different from traditional injection flaws. A SQL injection has a clean fix — separate code from data with parameterised queries. Prompt injection does not, for reasons we come to below.
// 02 Direct vs indirect prompt injection
The two forms differ in who delivers the payload, and the indirect form is the one that surprises teams.
Jailbreaking
The user's own input overrides intended behaviour. The classic form is "ignore your previous instructions and do X." Jailbreaks are the subclass aimed at breaking the model out of its safety and role constraints entirely. The attacker interacts with the model and crafts input to bypass its guardrails.
Via ingested content
The model reads external content — a web page, PDF, email or retrieved document — that contains hidden instructions it treats as commands. The attacker never talks to the model; they plant the payload in content the model will later process. This is the dangerous case for agents and RAG systems.
OWASP's own illustration of the indirect case: a user asks a model to summarise a web page that contains concealed instructions, causing the model to insert an image whose URL exfiltrates the private conversation. The user did nothing wrong; the poison was in the page. As applications increasingly let models read untrusted content and use tools, indirect injection becomes the primary concern.
// 03 Why it's considered unsolved
The reason prompt injection has no clean fix is architectural. A large language model receives its system instructions, the developer's prompt, and the user's (or the document's) content as one continuous stream of natural language. It has no built-in way to know which parts are trusted commands and which are untrusted data — the distinction that parameterised queries enforce for SQL simply does not exist for a model that treats all text as potentially instructive.
Every defence proposed so far — hardening the system prompt, adding delimiters, running input and output filters, training classifiers to spot attacks — reduces the success rate but does not close the gap, because determined adversarial prompting keeps finding new phrasings. This is why OWASP explicitly frames mitigation as risk reduction, not a solution, and advises designing systems to treat the model as an untrusted user: assume it can be manipulated, and limit the damage it can do when it is.
// 04 Real-world variants we test
Payload splitting
Spreading a malicious instruction across sections of a document so no single chunk looks suspicious, reassembled by the model.
Multimodal injection
Instructions hidden inside images that a vision-capable model reads and obeys.
Adversarial suffixes
Meaningless-looking character strings, discovered by optimisation, that reliably steer a model's output.
Multilingual & obfuscated prompts
Instructions in other languages, encodings or unusual formatting that slip past filters tuned for plain English.
In the wild these show up as hidden text in web pages, résumés and emails that AI assistants read; poisoned documents in a RAG corpus; and malicious instructions buried in calendar invites, support tickets or code comments that an agent processes — often with data exfiltration via markdown image URLs.
// 05 How we test for prompt injection
A prompt injection test is adversarial and systematic, not a single clever prompt. For the direct case, we run batteries of jailbreak and override techniques — role-play framings, payload splitting, adversarial suffixes, multilingual and obfuscated prompts, and multimodal image-embedded instructions — to establish where and how the model's guardrails can be broken. For the indirect case, which matters most for agents and RAG applications, we plant hidden instructions in the content the application actually ingests — the web pages it browses, the documents it retrieves, the emails or tickets it processes — and observe whether the model obeys them, and critically, whether an obeyed instruction can reach a tool or an exfiltration channel. Throughout, we test the blast radius: if injection succeeds, what can the model then do? That is where excessive agency and improper output handling turn a prompt trick into a real breach. It is a core part of our AI and LLM penetration testing.
// 06 Mitigations that actually help
Because you cannot eliminate prompt injection, the goal is to make a successful injection harmless. The controls that meaningfully help are architectural: apply least privilege to any tools the model can use, so an injected instruction cannot do much; require human-in-the-loop approval for consequential actions; sanitise the model's output before it reaches any downstream system, closing the improper-output-handling path; keep secrets out of the system prompt; isolate and access-control RAG data to limit poisoning and cross-tenant leakage; and layer input and output filtering as defence-in-depth, while never relying on it alone. In short: assume the model can be manipulated, and design so that when it is, the damage is contained.
// 07 Frequently asked questions
What is prompt injection?
Manipulating an LLM's behaviour via crafted input or ingested content. It's LLM01, the top OWASP LLM risk. The malicious content need only be parseable, not human-readable.
Direct vs indirect?
Direct (jailbreaking) is the user overriding behaviour in their input; indirect is hidden instructions in content the model reads, so the attacker never talks to it directly.
Why is it unsolved?
Models process instructions and data in the same channel, with no reliable separation between trusted commands and untrusted content. Defences reduce but don't eliminate the risk.
How do you test it?
Direct adversarial prompting and jailbreaks, plus planting hidden instructions in ingested content for indirect injection — then testing the blast radius through tools and output handling.
// 08 Sources
- OWASP Top 10 for LLM Applications 2025, LLM01:2025 Prompt Injection (OWASP GenAI Security Project) — direct/indirect distinction and OWASP's own indirect-injection example.
- OWASP GenAI Red Teaming Guide (2025) — testing methodology.