What is Prompt injection?

Prompt injection happens when text that a language model reads alters what the model does. The text does not have to be visible to a person, as long as the model parses it. It is listed as LLM01 in OWASP's 2025 list of risks for LLM applications.

The OWASP page separates two forms. In a direct injection, the user's own prompt changes the model's behavior, either deliberately or by accident. In an indirect injection, the model takes in outside content such as a web page or a file, and that content carries instructions that change its behavior. OWASP treats indirect injection as a separate form from direct injection, since the model accepts input from external sources such as websites or files.

The listed consequences include disclosure of sensitive information, exposure of system prompt details, unauthorized use of functions the model can reach, and commands run in connected systems. The suggested mitigations include constraining model behavior in the system prompt, validating output formats with ordinary code, filtering inputs and outputs, giving the model least-privilege access, requiring human approval for high-risk actions, labeling untrusted external content, and running adversarial tests.

OWASP states a clear limit. Because generative models are stochastic, it is unclear whether any fool-proof prevention exists, and the measures above reduce impact rather than remove the problem. OWASP describes jailbreaking as a form of prompt injection in which the attacker's input makes the model disregard its safety protocols.