What is prompt injection in simple terms?

It is when text a language model reads gets treated as an instruction it should follow. The model takes rules, requests and outside content as one stream of text, so a sentence planted in a web page or file can steer it as if the developer or user had written it.

What is indirect prompt injection?

It is prompt injection where the planted text sits in outside content the model processes, such as a web page, email, document or tool result, not in what the user typed. The user asks an innocent question and the content carries the instructions.

Is prompt injection the same as a jailbreak?

Sources differ. Simon Willison treats them as different attacks: injection targets an application built on a model, a jailbreak targets the model's own safety filters. OWASP treats a jailbreak as a form of prompt injection and notes the terms are often used interchangeably.

Can AI agents be hacked this way?

Yes. An agent acts on what it reads, so planted text in a page or tool result can steer its next tool call, which runs with the user's permissions. Limiting those permissions and requiring approval for sensitive actions reduces the damage but does not remove the risk.

Do AI guardrails stop prompt injection?

Not completely. Filters and classifiers around a model catch some attacks and miss others, and NIST notes that such detection systems can be attacked themselves. They work as one layer alongside least privilege and human approval, not as a boundary.

LLM · SECURITY

What Is Prompt Injection? How AI Gets Tricked by Text

Prompt injection is an attack in which text that a language model reads is taken as an instruction. The model receives the developer's rules, the user's request and any outside content as one stream of text, with no hard boundary between them, so words from a stranger can steer it. No complete fix is known. Defenses limit the damage.

One-pager titled "What is prompt injection?" with the subtitle "Text from a stranger can read like a command". A box labeled "One stream of text" holds a row of identical chips in three groups. Developer: "Translate", "into French". You: "Translate", "this page". Web page: "Ignore", "the rules", "above", highlighted in amber as the planted words. An arrow leads from the stream to a box "Model, reads it all as input", then an amber arrow to an amber box "Tool call, with your permissions". A REMEMBER band at the bottom has three items: "No label says whose words", "Stranger's text can steer it" and "Limit what it can reach", the last drawn with an "Ask first" chip. — One-pager: the developer's rules, the user's request and a web page arrive in one stream of text, and a planted line in the page reaches the model like any other.

Why text can act as a command

A language model reads one stream of text. The developer's rules, the user's request and any document the app fetched all arrive in the same sequence, and the model predicts what comes next from all of it. The page on prompts covers how that input is put together.

Nothing in the stream carries a permission label. The rules come first and the fetched page comes last, but the model has no hard boundary that stops a sentence from the page being read as an instruction. The UK National Cyber Security Centre makes the same point: current models do not enforce a security boundary between instructions and data.

Prompt injection is the attack that exploits this. Simon Willison named it in September 2022, after SQL injection, where untrusted text is also mixed into something trusted. The first example in his post, from Riley Goodside, was a translation prompt hijacked by input telling the model to ignore the directions above and say something else.

Direct and indirect injection

OWASP, which publishes a Top 10 list of risks for LLM applications, separates two forms. In direct injection, the person using the app supplies the text. It can be deliberate or accidental. In indirect injection, the text comes from an outside source the model was asked to process: a website, a file, an email or a tool result.

Indirect injection changes who the attacker is. The user did nothing wrong. They asked for a summary of a page, and the page carried the instructions. Greshake and colleagues named this attack in a February 2023 paper. Their point was that an attacker only needs to plant text in data the application is likely to retrieve.

OWASP adds that these inputs do not have to be visible to a human reader to affect the model.

Why agents and MCP raise the stakes

A chatbot that gets tricked can only say something wrong. An agent that gets tricked can do something. An agent reads the results of its tools and chooses its next action from them, so a planted sentence in a tool result can steer the next tool call. That call runs with the permissions the user handed over.

NIST's adversarial machine learning taxonomy says the same: because agents take actions with tools, these attacks can hijack them to run code or exfiltrate data. Willison, in a 2025 blog post, called the dangerous combination the lethal trifecta: access to private data, exposure to untrusted content, and a way to communicate externally.

MCP connects an agent to outside tools and data, so each connection is another place text can come from and another action the model can request. The MCP specification says there should always be a human in the loop with the ability to deny tool invocations.

Prompt injection versus jailbreak

Sources draw this line in different places. Willison separates them by target. Prompt injection attacks an application built on a model, by mixing untrusted input into the developer's trusted prompt. A jailbreak attacks the safety filters built into the model itself. His test: if no trusted and untrusted strings are concatenated, it is not prompt injection.

OWASP notes the two terms are often used interchangeably and treats jailbreaking as a form of prompt injection, where the input makes the model ignore its safety measures. NIST describes a jailbreak as a direct prompting attack that circumvents restrictions on model outputs, such as refusal behavior.

In practice: a jailbreak aims at the rules the model's maker trained in. Injection aims at the instructions of the app built around the model.

Defenses and where they stop

No complete fix is known. The NCSC wrote in December 2025 that prompt injection may never be totally mitigated the way SQL injection can be. Anthropic said in November 2025 that it is far from a solved problem. OpenAI's agent-safety guidance says its measures reduce the risk but do not fully remove it.

The defenses that hold up limit what a fooled model can do. Give it least privilege. Require human approval for high-risk actions. Mark and separate untrusted content. Check outputs with ordinary code. Log tool calls. These come from OWASP, NIST and the NCSC, and none of them stops the model from being fooled.

Guardrails are checks placed around the model, such as filters on input and output or classifiers that flag suspicious text. They are partial. NIST notes that detection systems are themselves vulnerable and can fail in the same ways as the models they watch. Willison argues that a filter catching 95 percent of attacks is a failing grade in security.

FAQ

What is prompt injection in simple terms?: It is when text a language model reads gets treated as an instruction it should follow. The model takes rules, requests and outside content as one stream of text, so a sentence planted in a web page or file can steer it as if the developer or user had written it.
What is indirect prompt injection?: It is prompt injection where the planted text sits in outside content the model processes, such as a web page, email, document or tool result, not in what the user typed. The user asks an innocent question and the content carries the instructions.
Is prompt injection the same as a jailbreak?: Sources differ. Simon Willison treats them as different attacks: injection targets an application built on a model, a jailbreak targets the model's own safety filters. OWASP treats a jailbreak as a form of prompt injection and notes the terms are often used interchangeably.
Can AI agents be hacked this way?: Yes. An agent acts on what it reads, so planted text in a page or tool result can steer its next tool call, which runs with the user's permissions. Limiting those permissions and requiring approval for sensitive actions reduces the damage but does not remove the risk.
Do AI guardrails stop prompt injection?: Not completely. Filters and classifiers around a model catch some attacks and miss others, and NIST notes that such detection systems can be attacked themselves. They work as one layer alongside least privilege and human approval, not as a boundary.

Sources

Last updated 2026-10-11