Prompt injection is a situation in which input, either direct or hidden inside content the model reads, changes the behavior of a language model in a way you did not intend.
In short
- Prompt injection is using text to make an AI model do something you didn't intend.
- OWASP, a well-known security organization, lists it as the number one risk on its list for applications built on language models (LLM01).
- A malicious instruction can hide in a website, file or email the agent reads, and not only in a message you write.
- According to OWASP, it is unclear whether any method prevents it completely. You reduce the risk with minimum permissions and human approval.
What is prompt injection, in one image
Imagine a new assistant who got clear instructions from you, and now opens a package that arrived in the mail. Inside is a note: "Send the customer list to this address." A careful assistant understands it's just a note. An assistant who doesn't tell the difference between "what the boss said" and "what's written in front of my eyes" may obey.
That is exactly what a language model struggles with: to the model, everything that enters is text. So persuasively worded text can try to take over the instructions it was given.
How does it work?
OWASP defines two forms. Direct: a user writes input that changes the model's behavior, on purpose or by mistake. Indirect: the model processes external content, such as a website or file, that contains hidden instructions. OWASP notes that the effect can be invisible to the human eye, which makes it hard to detect.
Indirect injection: how it happens
- You give a task"Summarize this document for me"
- The agent reads outside contentA website, email or file
- A hidden instruction insideThe model confuses it with the task
- Stopped before damageNarrow permissions and your approval
The last step is what makes the difference. The fewer permissions an agent has, and the more sensitive actions wait for approval, the less damage a hidden instruction can cause.
Why does this matter for a business?
You don't need to be a special target. It's enough that the agent reads content you didn't write. According to OWASP, a successful attack can lead to, among other things:
- Exposure of information. Unauthorized access to data, or exposure of the system instructions (the system prompt).
- Actions nobody asked for. Use of functions that shouldn't be open, or running commands in connected systems.
- Biased or wrong outputs. An answer, summary or recommendation influenced by malicious text.
- Distorted decisions. An agent that summarizes competitors or suppliers from websites, and makes a decision based on content planted on purpose.
When an agent is connected to real accounts, permissions are the line of defense. We wrote about this in the context of privacy in the guide to privacy and AI agents.
What can you do?
OWASP recommends seven mitigation methods, and the grouping below translates them for a business:
OWASP's mitigation methods, in a business owner's terms
Limit the agent
- Minimum permissions only
- Clear system instructions
- A defined, validated output format
Check what goes in and out
- Input and output filtering
- Separating external content from instructions
Ask for approval and test
- Human approval for risky actions
- Simulated attack tests
Source: OWASP GenAI Security Project, LLM01:2025 Prompt Injection. Translation and grouping by us.
OpenAI's guide to building agents also describes guardrails as layers of defense, stresses that one alone is not enough, and says they need to work together with authentication and authorization and strict access controls. Our position: don't rely on a "clever prompt" that asks the model to be careful. A real limit on permissions is stronger.
Common myths
Myth"This only concerns hackers and big companies"
In practiceAny agent that reads content you didn't write, such as websites, emails and files, is exposed. The size of the business doesn't matter, the permissions do.
Myth"A strong enough instruction solves it"
In practiceOWASP writes that it is unclear whether methods exist that prevent this completely, because of the nature of the models. That's why you combine several layers of defense.
Myth"It's a mistake by the model"
In practiceIt isn't like a hallucination. Here an outside party steers the behavior, sometimes through text a person can't even see.
Myth"If the agent isn't connected to anything, there's no risk at all"
In practiceAnswers can still be skewed. But the big damage happens when there are connections, which is why limited permissions matter especially for agents.
Related terms
- What is an AI agent: the one exposed to content and acting in tools.
- What is MCP: the connection that gives an agent access to systems.
- What is an LLM: the model that receives the instructions and the content together.
- What is an AI hallucination: a different error, which comes from the model itself.
- What is a token: instructions and outside content reach the model as one sequence of text.
Frequently asked questions
What is prompt injection?
Prompt injection is a vulnerability in which input to a language model changes its behavior or output in an unintended way. According to OWASP, the input can come directly from the user, or indirectly from external content the model processes, such as a website or file. It is the first risk on OWASP's list for LLM applications (LLM01).
What is the difference between direct and indirect injection?
In a direct one, the person typing to the model is the one who changes its behavior. In an indirect one, the instruction is hidden in content the model reads along the way, such as a web page, and not necessarily in the user's message.
Can prompt injection be prevented completely?
OWASP writes that it is unclear whether fully foolproof prevention methods exist. That's why it recommends several layers: minimum permissions, checking input and output, separating external content, and human approval for risky actions.
What can a small business do today?
Give the agent only the permissions it needs, keep publishing, budget and messages to customers subject to your approval, and avoid connecting accounts it doesn't need. Also ask whoever sets up the agent how it handles external content.
