What is Prompt Injection?
Prompt Injection is an attack technique in which malicious instructions are embedded in text that an LLM application reads, causing the model to ignore its original instructions and follow the attacker's instead. It targets any system that passes untrusted input or retrieved content directly to a large language model.
What it is
Prompt injection exploits the way large language models treat all text in their context window as instructions. An attacker places crafted text somewhere the model will read it. That text tells the model to override its system prompt, reveal confidential data, produce harmful output, or take unintended actions.
There are two main forms:
- Direct prompt injection. The attacker controls the user-facing input field and types instructions directly into the prompt.
- Indirect prompt injection. The attacker plants instructions in external content the application retrieves, such as a web page, a document, an email, or a database record. When the LLM reads that content as part of a retrieval-augmented generation (RAG) pipeline or tool call, the hidden instructions execute.
Indirect injection is harder to defend against because the malicious content never comes from the user. It arrives through a trusted data source.
Why it matters
LLM applications often have access to sensitive tools: code execution, file systems, APIs, email, and databases. A successful injection can cause the model to exfiltrate data, send unauthorized messages, delete records, or pivot to other systems. In agentic AI architectures, where models chain tool calls autonomously, a single injected instruction can trigger a long sequence of harmful actions before a human notices.
How tools address it
LLM Guardrails products sit between the application and the model. They inspect prompts and retrieved content before the model sees them, and they inspect model outputs before the application acts on them. Specific techniques include:
- Pattern matching and classifiers trained to detect injection attempts in input text
- Sandboxing retrieved content so it is treated as data, not instructions