Prompt Injection
An attack where malicious input causes an AI system to ignore its instructions or execute unintended actions.
What is Prompt Injection?
Prompt injection — both direct (user input) and indirect (via retrieved content) — is the most discussed LLM security risk. Defences include input sanitisation, instruction-data separation, output filtering, and treating retrieved text as data rather than instructions. No single defence is complete; layered guardrails at the platform level are required. See AI Guardrails and Enterprise AI Agent Security.
What is an example of Prompt Injection?
An agent summarizes an external web page containing hidden instructions to ignore its task and upload internal files. A secure runtime treats page text as untrusted data and denies the unapproved file-access and network actions.
How is Prompt Injection different from related concepts?
Prompt injection targets an application’s instruction hierarchy and connected tools. Jailbreaking usually tries to bypass a model’s safety behavior. The techniques can overlap, but the assets and mitigations differ.
What should enterprises evaluate for Prompt Injection?
- Assume all retrieved and tool-returned content is hostile, and keep authorization outside the model.
- Limit tool permissions, arguments, destinations, and data access; require approval for consequential actions.
- Red-team direct, indirect, encoded, multilingual, multimodal, and multi-step attacks and monitor attempted violations in production.
Related terms
Authoritative sources
Primary sources for the formal meaning, requirements, or original research behind Prompt Injection:
- Prompt Injection — source for Prompt Injection OWASP Foundation
- LLM06:2025 Excessive Agency — source for Prompt Injection OWASP GenAI Security Project
Putting Prompt Injection to work?
VDF AI runs governed AI agents on your own infrastructure — on-premises, sovereign cloud, or air-gapped. Book a working session to map the architecture.
Talk to VDF AI