Prompt injection is an attack in which someone hides instructions in text that an AI application processes, so the AI carries out those instructions instead of your request. The attack doesn’t target the software itself, but the way a language model processes text.
A language model receives your request and the contents of an email, web page or document as one continuous text. A sentence in that content that looks like an instruction is sometimes treated by the model as an instruction too.
As long as an AI assistant only returns text, the damage is limited to a wrong answer. Once AI agents send emails, delete files or fill in forms themselves, a successful injection carries out real actions.
According to the UK’s NCSC and OpenAI, prompt injection may never be fully solved, and Anthropic calls it still far from solved. Defence therefore centres on limiting the damage, with minimal permissions and a human check.
What does prompt injection mean?
Prompt injection literally means injecting instructions into the prompt: malicious text that overrides or supplements the original request to a language model.
Simon Willison proposed the name on 12 September 2022, prompted by an example from Riley Goodside. Goodside showed that a language model ignored its earlier instructions as soon as the input asked it to.
Willison immediately drew the comparison with SQL injection, a well-known attack on databases. That comparison holds for how it works, but not for the solution.
How does a prompt injection work?
A prompt injection works because a language model draws no hard line between instructions and data. The provider’s system prompt, your question and the text of an email all come in as a single sequence of words.
According to the UK’s NCSC (December 2025), a language model keeps predicting the next piece of text, without any internal distinction between instruction and content. A sentence like “ignore the previous instructions” therefore doesn’t get a lower status than your own request.
Providers are working on models that give the user’s instructions priority over inserted text. According to the NCSC, such measures reduce the chance of a successful attack but don’t eliminate it.
What is the difference between direct and indirect prompt injection?
Direct and indirect prompt injection differ in who supplies the instruction. With direct prompt injection, the user types the manipulative text into the chat window themselves, deliberately or by accident.
With indirect prompt injection, the instructions sit in external content the AI application retrieves, such as a web page or a file. OWASP describes both forms in its 2025 Top 10 for LLM Applications.
Greshake et al. described indirect prompt injection in detail in February 2023 and showed that an attacker can steer a system without ever talking to it. For firms, that is the relevant form: the attacker isn’t at the keyboard, but in the email or document that comes in.
What does a prompt injection look like in practice?
In practice, a prompt injection comes in through three channels every firm uses daily: email, web pages and documents. The examples below were published by OpenAI, Anthropic and the NCSC.
How does an attack via email work?
An attack via email works with a message that contains hidden instructions for the AI assistant. In December 2025, OpenAI described an attack on its own browser agent in which an attacker placed such an email in a user’s inbox.
The user later asked the agent to write an out-of-office message. While doing so, the agent read the planted email, followed the hidden instruction and sent a resignation letter to the CEO on the user’s behalf.
In August 2025, Anthropic tested an email that posed as a message from the employer and asked for the mailbox to be cleaned up, with no further confirmation. Before the new defence, the agent deleted the user’s emails without asking anything.
How does an attack via a web page work?
An attack via a web page works with text that is invisible to the reader but that an AI browser does read, for example white letters on a white background. An agent that browses on its own, follows links and fills in forms comes across such pages without the user seeing them.
Browser agents such as ChatGPT agent mode work this way, and according to Anthropic no browser agent is immune to prompt injection.
How does an attack via a document work?
An attack via a document works with hidden text in a file that an AI application summarises or assesses. One example from the NCSC is a CV with hidden text that gives an instruction to the AI tool screening job applications.
A firm receives documents from outside every day: PDFs from an opposing party, annual accounts supplied by a client, quotes. If you have an AI assistant summarise such files, it also processes text that someone else wrote.
What can go wrong with a successful prompt injection?
With a successful prompt injection, four things can go wrong, depending on the AI application’s permissions:
- Data leak: the AI assistant sends confidential information from your mailbox or case file to an attacker’s address.
- Unwanted actions: the agent sends messages, deletes files or makes a purchase nobody asked for.
- Manipulated output: a summary or assessment turns out differently from what the content justifies, without anyone noticing.
- Misuse of connections: connected tools and systems are used for actions outside the request.
The damage grows with the application’s permissions. A chatbot without connections can at most give a wrong answer; an agent with access to mail and case files acts on your behalf.
Why can’t prompt injection be fully prevented?
Prompt injection can’t be fully prevented, because the cause lies in how language models work and not in a programming error. For SQL injection there is a structural solution: parameterised queries keep input and commands strictly separate.
No such separation exists for language models, the NCSC wrote in December 2025. According to the NCSC, it is therefore a residual risk you manage, not a problem you solve.
The providers write something similar. According to OpenAI, prompt injection, like scams and social engineering, will probably never be fully solved, and in November 2025 Anthropic called it still far from solved.
How do you reduce the risk of prompt injection?
You reduce the risk of prompt injection by keeping the consequences small, not by relying on detection. Six measures limit the damage:
- Give an AI application only the permissions the task requires, for example read access without send rights where that is enough.
- Ask for confirmation before an agent sends, deletes, publishes or buys anything.
- Keep sensitive case files separate from agents with internet access, so a web page never gets near client data.
- Give specific instructions instead of a broad request such as “deal with my inbox”; OpenAI gives the same advice.
- Log what the application reads and does, so you can see afterwards where an instruction came from.
- Treat every connection via an MCP server or plug-in as new access that lets an injection reach further.
For my own automations, I start with three questions: what data goes in, where it ends up and who has access to it. I treat a skill fetched from outside as instructions from a stranger that my AI carries out automatically. The same check applies there as for any other external input, and which tools and accounts are allowed is something you set out in your policy on responsible AI use.
Is prompt injection the same as a jailbreak?
No, a jailbreak is a form of prompt injection, but not the same thing. In a jailbreak, someone tries to make the model ignore its safety rules, as OWASP describes it.
Prompt injection is broader: the attack steers an application’s behaviour, even when no safety rules are involved. For a firm, that broader risk is the relevant one, because the attack comes in through ordinary emails and documents.
Is a successful prompt injection a data breach?
A successful prompt injection is a data breach as soon as personal data reaches unauthorised people or is lost. The GDPR rules on a personal data breach then apply.
Under Article 33 of the GDPR, the controller must notify the supervisory authority of such a breach without undue delay and, where feasible, within 72 hours. In the Netherlands, that is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP). That notification obligation only lapses when the breach is unlikely to result in a risk to the people concerned.
Is prompt injection in the OWASP Top 10?
Yes, prompt injection is in first place in the OWASP Top 10 for LLM Applications 2025, with the code LLM01. That puts it at the top of the list from OWASP, an international non-profit organisation that publishes overviews of the most important security risks in software.
Frequently asked questions about prompt injection
The topic also raises questions about related attacks and about testing your own application.
Can prompt injection also happen via an image?
Yes, as soon as an AI application processes images as well as text. In its explanation of LLM01, OWASP explicitly mentions instructions hidden in an image alongside innocent-looking text. A screenshot or scanned attachment is therefore just as much external input as an email. So treat an image you receive from outside with the same caution as a document.
What is the difference between prompt injection and data poisoning?
The difference between prompt injection and data poisoning lies in when the attack happens. Prompt injection happens during use, via text the application reads at that moment. With data poisoning, according to OWASP, an attacker manipulates the training data or the embeddings, so the model itself ends up with a hidden weakness or backdoor. OWASP treats data poisoning as a separate risk in the Top 10, under the code LLM04.
What is system prompt leakage?
System prompt leakage is the risk that an AI application’s hidden instructions leak out, including information that was never meant to be found. OWASP lists it as LLM07 in the 2025 Top 10 and warns that such information makes other attacks easier. So never put passwords or API keys in a system prompt. According to OWASP, the system prompt is not a security measure; controls such as authorisation belong outside the language model.
How do you test an AI application for prompt injection?
You test an AI application for prompt injection by simulating attacks, before you put the application into use and at fixed moments afterwards. OWASP recommends regular penetration tests and attack simulations in which you treat the model as a user you don’t trust. In a test, for example, offer an email with a hidden instruction and see whether the application carries it out. Record the outcome, so you can test again after every change.
How do you learn to build an AI automation with a check step?
You build an AI automation with a check step by deciding in advance what the AI does by itself and where a person reviews it. That way, a prompt injection can’t lead to an action unnoticed. In the AI Automation Course you learn to have Claude use tools and to decide when an agent makes sense.
You also learn to manage your API key securely, and you finish with your own workflow with a check step, tested on your own examples.
