What is prompt injection? The attack on LLM applications, defined

Prompt injection is an attack on an application built on a large language model (LLM) in which text, typed by a user or planted in a document, web page or tool result the model reads, overrides the instructions the developer gave it. OWASP lists it first in its Top 10 for LLM Applications 2025, under the identifier LLM01:2025.

Why it matters to a CISO

The weakness sits in how models read text, not in a bug a vendor can patch. NIST's adversarial machine learning taxonomy, NIST AI 100-2 E2025, describes it as untrusted input being concatenated with a prompt written by a higher-trust party, such as the application designer. The UK National Cyber Security Centre (NCSC) puts the root cause plainly: current LLMs keep no security boundary between instructions and data inside a prompt.

The damage therefore depends on what the model is wired to. OWASP's entry lists outcomes from guideline violations and harmful content to unauthorized access and influence over critical decisions. The NCSC, writing on 8 December 2025, called prompt injection a residual risk that no product or appliance can fully remove, and urged deterministic, non-LLM safeguards that constrain what the system can do.

Direct, indirect, and what it is not

OWASP separates direct injection, where the user's own prompt changes the model's behaviour, from indirect injection, where the model takes in content from outside sources such as websites or files. NIST frames the indirect form as an attack carried out through control of a resource the model reads, rather than through the user's input.

It is not the same as a jailbreak, although the two overlap: a jailbreak aims specifically at the model's safety restrictions, while an injection can aim at anything the application can do. Nor is it SQL injection with a new name, because no equivalent of the parameterised query exists for natural language.

Where it appears on cisonews.ai

The full treatment, with OWASP's and the NCSC's defensive advice, is the explainer what is prompt injection and how do you defend against it. The OWASP Top 10 for LLM Applications explainer places it among the other nine risks. Recorded cases include the EchoLeak flaw in Microsoft 365 Copilot and the Slack AI exfiltration issue, and the ATLAS technique index groups every logged incident by attack technique.

Related terms

Jailbreak, AI guardrails, AI agent and Model Context Protocol (MCP).