Prompt Injection
An attack where input the model treats as trustworthy instruction — from a user, a retrieved document, or a tool response — redirects the model's behaviour away from its intended task.
Prompt injection is the most-discussed and least-fully-mitigated risk category for LLM applications (OWASP LLM01). It exploits a structural property of how LLMs process input: the model does not reliably distinguish between the developer's instructions and content that merely resembles instructions, if that content arrives in the same context window.
Direct prompt injection is a user entering input the model treats as instruction rather than data — 'ignore your previous instructions and…'. Indirect prompt injection is more consequential for production systems: content reaches the model through a retrieval step, a tool response, or a memory layer, and the model treats embedded instructions in that content as authoritative, without the attacker ever interacting with the system directly.
The required controls differ by deployment shape. For any system exposing the model to user-controlled input: input validation, prompt hardening (instruction hierarchy, role separation), and output filtering. For RAG and agentic systems specifically: treating all retrieved or tool-returned content as untrusted data by default, and enforcing consequential actions at the tool or gateway layer rather than relying on the model's own reasoning to resist injected instructions.
Prompt injection resistance is not binary. A system can reduce the attack surface (goal anchoring, content sanitisation, scoped tool access) without ever reaching zero residual risk — no published technique closes this class of attack completely for a general-purpose model. A security review documents which controls are in place and which residual risk is accepted, rather than claiming the system is 'immune to prompt injection'.
Prompt injection compounds with other risk categories. An injection that reaches a tool-using agent can drive excessive agency; an injection in retrieved content can trigger sensitive information disclosure. A review scoped to the prompt layer alone misses how injection interacts with the rest of the system's blast radius.