What is prompt injection and how do you defend against it?

Prompt injection is an attack in which text fed to a large language model, typed by a user or hidden in content the model reads, changes the model's behaviour in ways its developers did not intend. OWASP lists it as LLM01:2025, the top entry in its Top 10 for LLM applications, and the UK National Cyber Security Centre (NCSC) wrote on 8 December 2025 that the realistic goal is to reduce its likelihood and impact rather than eliminate it.

The root cause, in the NCSC's words, is that current LLMs do not enforce a security boundary between instructions and data inside a prompt. OWASP adds that injected text does not need to be visible to a human at all, as long as the model parses it.

What is the difference between direct and indirect prompt injection?

Direct injection comes from the person typing into the model; indirect injection arrives inside external content, such as a web page or file, that the model is asked to process. OWASP notes that direct injection can be deliberate or accidental, and defines the indirect form as an LLM taking in input from outside sources like websites or files.

NIST frames the problem in similar terms. Its adversarial machine learning taxonomy, NIST AI 100-2 E2025, published in March 2025, covers evasion, poisoning, privacy and misuse attacks against generative AI systems. NIST's Center for AI Standards and Innovation describes agent hijacking as a form of indirect prompt injection, in which malicious instructions are planted in data that an AI agent later ingests.

The NCSC's example is a recruitment tool asked to score CVs, where a candidate hides an instruction in the CV to approve it for interview. The attacker never touches the AI system directly; their text simply gets processed and treated as a command.

Jailbreaking is a related term. OWASP treats it as a type of prompt injection whose aim is to make the model ignore its safety protocols entirely.

Why can't prompt injection be patched like SQL injection?

Because there is no parameterised-query equivalent for a language model. The NCSC explains that fixes for SQL injection work by separating data from instructions, so a database engine never runs user input as a command, whereas an LLM just predicts the next likely token from all the text it has been given.

OWASP reaches a similar conclusion, saying it is unclear whether any fool-proof prevention method exists given the stochastic way models work. The NCSC therefore recommends managing the risk and its impact rather than waiting for a single fix.

Agents raise the stakes. NIST points out that LLM-based agents typically merge trusted developer instructions with task data into one input, which is exactly the gap attackers exploit.

What can a successful prompt injection do?

It can leak data, trigger unauthorised actions or corrupt outputs, depending on what the model is connected to. OWASP's scenarios include a support chatbot told to ignore its guidelines, query private data and send emails, and a summarised web page whose hidden instructions exfiltrate a private conversation through an image link.

Multimodal models widen the channel, since instructions can be hidden in images sent alongside harmless text. When NIST CAISI added remote code execution, database exfiltration and automated phishing tasks to its agent tests, it was frequently able to make the agent follow the malicious instructions.

How do you defend against prompt injection?

Layer controls that limit what a fooled model can reach, rather than relying on filters to catch every attack. OWASP recommends giving the application its own API tokens and handling privileged functions in code instead of handing them to the model, validating outputs against defined formats with deterministic code, and red-teaming the model as an untrusted user.

Marking external content helps at the margin. The NCSC cites research showing that separating data from instructions, even by wrapping outside content in XML tags, makes injection harder, but it warns against deny-lists of known bad phrases because attackers can rephrase in endless ways.

Detection is the last layer. The NCSC advises logging enough to spot suspicious activity, potentially including full LLM input and output plus tool and API calls, and notes that failed tool calls can reveal an attacker still refining an attack.

For a security leader, the working test is simple: assume any document, email or web page an AI system reads could carry instructions, and ask what the system could do with its current permissions if it obeyed them.