What is prompt injection, and how do you defend against it?

Prompt injection is entry LLM01 in the OWASP Top 10 for LLM Applications 2025, the first item on the list. OWASP describes it as prompts that alter a model's behavior or output in unintended ways, and notes the text does not need to be visible to a person, only readable by the model. MITRE ATLAS, the public knowledge base of attacks on AI systems, catalogs it as technique AML.T0051, LLM Prompt Injection: inputs that cause the model to ignore parts of its original instructions and follow the attacker's instead.

What is the difference between direct and indirect prompt injection?

The difference is who writes the instruction and how it reaches the model. In a direct injection the person typing is the attacker. In an indirect injection the attacker plants instructions in content the assistant reads later on someone else's behalf: an email it summarizes, a web page it browses, a shared document, or a file pulled in by a search. NIST observes that indirect attacks are mounted by a third party, and that the assistant's own user is often the one harmed.

Is a jailbreak the same as prompt injection?

A jailbreak is one kind of prompt injection. OWASP defines jailbreaking as prompt injection that makes the model disregard its safety protocols, and NIST classes a jailbreak as a specific kind of direct prompting attack. In practice the target differs. A jailbreak goes after the model's safety training, to get content it would normally decline to produce. Prompt injection in general goes after the application around the model: its data, its tools, and the actions it is allowed to take. A jailbroken chatbot says something harmful; an injected agent with email access does something harmful. This page describes the categories and leaves out working attack text.

Why can't filtering stop prompt injection?

SQL injection was brought under control with parameterized queries, which keep data and commands in separate channels so the database never runs user input as a command. The UK National Cyber Security Centre (NCSC) explained in December 2025 why that fix has no equivalent here: a language model draws no boundary between instructions and data inside a prompt. Everything is text, and the model predicts the next token from all of it. NCSC calls the model an inherently confusable deputy and advises reducing the likelihood and impact of injection, since the risk itself does not go away.

The other primary sources agree. OWASP writes that it is unclear whether fool-proof prevention exists. NIST AI 100-2 E2025 states that current mitigations do not offer full protection and recommends designing systems on the assumption that injection succeeds whenever a model reads untrusted input. Microsoft's Security Response Center describes indirect injection as an inherent risk of probabilistic models and defends against it in layers. A filter is a classifier, and an attacker can rephrase until the wording falls outside what it learned. Filters belong in the stack as one layer among several.

What are real examples of prompt injection attacks?

• EchoLeak, Microsoft 365 Copilot (June 2025). Researchers at Aim Security showed that a crafted email sitting in an Outlook inbox could carry hidden instructions. When the user later asked Copilot an ordinary question, Copilot retrieved the email alongside internal data and could send that data out through a link. Microsoft rated it CVE-2025-32711, critical at CVSS 9.3, fixed it on the service side, and reported no evidence of exploitation.
• Slack AI (August 2024). A researcher showed that a message posted in a public channel could instruct Slack AI, when it answered another user's question, to surface data from that user's private channels behind a phishing link. Slack deployed a patch on August 20, 2024 and reported no evidence of unauthorized access to customer data.

Both follow the same pattern: the assistant read an attacker's text in the same context as private data, and it had a route to send something outward. Removing either condition breaks the attack, which is why the defenses below concentrate on access and outbound routes.

How do you defend against prompt injection?

Every framework cited here reaches the same design rule: assume some injections succeed, and limit what a successful one can do.

The first two rows carry the most weight. NCSC recommends deterministic safeguards, meaning ordinary code and permissions that do the same thing every time, to constrain what the system can do. A model that can read a stranger's email and also send email on your behalf needs either fewer permissions or a person in between. More on where those controls sit is in what AI enforcement at runtime looks like.

What is a system prompt, and does it protect against injection?

A system prompt is the set of instructions a developer gives the model before any user message: its role, its rules, and what to refuse. OWASP lists a well-written system prompt as a first mitigation. It sits in the same stream of text as the attack, so it shapes behavior and enforces nothing. Treat the system prompt as guidance and put enforcement in code outside the model: permissions, approvals, and output checks.

What is an LLM firewall?

LLM firewall is a market term for a service that inspects prompts and responses and blocks ones that look malicious. Microsoft's Prompt Shields is one documented example of the classifier approach. It is a useful detection layer with the same limit as any filter: a new phrasing gets through. Pair it with the permission and approval controls above. Definitions of the surrounding terms are in the AI glossary.