Prompt injection

In short

Prompt injection is an attack where someone slips their own instructions into text an AI system reads, such as a web page, email or document, so the AI follows the attacker instead of its user or developer.

Also called: Indirect prompt injection, Direct prompt injection, Prompt injection attack
Topic: Using AI tools
Level: Some background helps
First described: Simon Willison named the attack "prompt injection" on 12 September 2022, after Riley Goodside showed GPT-3 could be told to ignore its previous directions⁶.

AI apps are often built by joining a developer's instructions to text from elsewhere, then sending the lot to a language model. NIST defines prompt injection as an attack that "exploits the concatenation of untrusted input with a prompt constructed by a higher-trust party such as the application designer"¹. The model sees one stream of text and has no reliable way to tell instructions from data.

There are two kinds. In direct prompt injection, the user types the attack themselves¹². In indirect prompt injection, the attacker plants instructions in content the AI will later read, such as a website, file or email². A 2023 paper by Kai Greshake and colleagues showed indirect attacks working against Bing's GPT-4-powered chat, including data theft and manipulating which tools the AI called³.

The risk grows with AI agents. An assistant that can send emails, browse or run code can be steered by a booby-trapped web page into misusing those powers. The UK's National Cyber Security Centre warned in December 2025 that prompt injection "may never be totally mitigated" in the way SQL injection can, and advises treating models as "inherently confusable" and limiting what they can do⁴.

Defences reduce rather than remove the risk. They include detecting attack attempts and training models to give lower priority to instructions found in data⁴. OpenAI's Model Spec, for example, tells its models that instructions inside quoted text, files and tool outputs have no authority by default⁵.

Example

A job applicant hides text in a CV telling the AI to recommend them. An AI screening tool that reads the file may follow it, while a human reviewer never sees the text. OWASP lists this CV attack as a known scenario².

Why it matters

As AI assistants gain access to inboxes, files and the web, anything they read becomes a possible attack. It is widely seen as one of the hardest security problems for AI agents.

Questions people ask

What is the difference between prompt injection and a jailbreak?

A jailbreak tries to make a model break its safety rules, and NIST classes it as a direct prompting attack by the user¹. Prompt injection is broader: it hijacks an app's instructions, often through hidden text in content the AI reads. OWASP treats jailbreaking as one form of prompt injection².

Can prompt injection be fixed?

Not fully, with current technology. The UK National Cyber Security Centre says it may never be totally mitigated, because language models do not separate data from instructions. It recommends designing systems to limit the damage instead⁴.

Why is it called prompt injection?

Because it resembles SQL injection, an older attack where malicious input is mixed into a database command. Simon Willison proposed the name in 2022 for that reason⁶. The NCSC warns the comparison can mislead, since SQL injection has a clean fix and prompt injection does not⁴.

Related terms

Sources

Back to the glossary