AI security concept

What is prompt injection?

Reference

What is prompt injection? It is an attempt to steer an AI application by placing instructions in a user prompt or in content the application reads. The instructions may try to change the system’s intended behavior, expose information, or trigger an action. The risk depends on how the application handles that content and what data or tools it makes available.

Reviewed 2026-10-09

What it is

Prompt injection is a security risk in an application that uses a large language model (LLM), a model that handles and generates text. An attacker places instructions in text the application processes, hoping the model will treat them as directions rather than as material to analyze. For example, a document being summarized might contain a request to ignore the user’s task and reveal private information. The attempt may change the response, but its consequences depend on the application and the model’s behavior.

How it works

The problem arises when an application gives the model trusted directions and untrusted content together, without a reliable boundary between them. An attacker can put instructions in the user’s message, or hide them in a webpage, file, email, or other material the model is asked to read. If the model follows those instructions, its answer may be redirected. If the application also connects the model to data or tools, the attempt may reach beyond the answer, so permissions and approval checks matter too.

Where it fits

Prompt injection belongs to AI application security: it concerns how an application handles instructions and outside content. A direct attempt arrives in a user’s message; an indirect attempt arrives through external content, such as a webpage or file. Jailbreak is a closely related term often used for attempts to get an AI system to bypass its rules. The terms overlap, though usage varies. Prompt injection can also be a route to data exposure or unauthorized actions, but those are possible outcomes, not the definition of the attack.

Common confusions

A prompt injection is an attempt, not proof that the model followed the instruction or that information was stolen. The outcome can range from a changed answer to an action through a connected tool; some attempts have no effect. An indirect instruction does not have to be visible to a person if the application extracts or processes it. Also, adding labels around outside text can help clarify its role, but text labels alone do not enforce a security boundary. Applications need controls on the data and actions available to the model.

Questions people ask

Can a webpage cause prompt injection?

Yes. If an AI application fetches or analyzes a webpage, instructions in that page can be processed as part of the task. That is an indirect prompt injection; it does not require the user to type the attacker’s instructions.

Does prompt injection always work?

No. It describes an attempt to influence an AI application. Whether it changes the answer or leads to another effect depends on how the model handles the content and what the application allows it to access or do.

Is prompt injection the same as a jailbreak?

The terms overlap. “Jailbreak” commonly refers to trying to make an AI system bypass its rules, while prompt injection also covers instructions delivered through outside content, such as a document or webpage.

Does prompt injection mean my information was stolen?

No. An attempt may seek sensitive information, but that does not mean it succeeded. Data exposure is one possible impact, especially when an application gives the model access to sensitive information or connected tools.

Learn more

LLM Prompt Injection Prevention Cheat Sheet
Explains direct and indirect prompt injection and describes application-level controls.
Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection
A research paper examining how indirect instructions in retrieved content can affect applications and connected services.

What changed

Sources

Part of AI security: Threats in prompts and data Tools, permissions, and application boundaries Test the workflow and its access boundaries