What prompt injection is
Prompt injection is the top-ranked risk in the OWASP Top 10 for LLM Applications (LLM01, https://genai.owasp.org). It occurs when attacker-controlled text is interpreted by the model as instructions, causing it to ignore its system prompt, reveal hidden information, or take unintended actions through connected tools.
The root cause is architectural: current LLMs do not reliably separate trusted instructions from untrusted data when both arrive as text in the same context. That is why prompt injection is best treated as a design constraint to contain rather than a bug to patch away.
Direct injection test cases
Direct injection is delivered in the input the user controls, aiming to override the application's instructions. Testing works through a graded set of payloads and observes whether the model deviates from its intended behavior.
- Instruction override: input that asks the model to disregard prior instructions and follow new ones.
- System prompt extraction: input that tries to make the model reveal its hidden instructions or configuration.
- Role or persona manipulation that attempts to unlock restricted behavior.
- Delimiter and formatting tricks that try to break out of the intended input boundary.
Indirect injection test cases
Indirect injection is more dangerous in practice because the attacker never speaks to the model directly. Instructions are hidden in content the model later ingests: a web page it browses, a document it summarizes, an email in an inbox it processes, or a record in a retrieval database.
Testing plants payloads in each retrievable source and checks whether the model acts on them. In tool-enabled and agentic systems, the goal of a realistic test is to show that injected content can trigger a consequential action or exfiltrate data.
- Embed instructions in a document, then have the application summarize or process it.
- Place instructions in a web page or linked resource the agent will fetch.
- In RAG systems, seed a retrievable record with instructions and observe retrieval-time influence.
- For agents with tools, test whether injected content can cause data exfiltration or unauthorized tool calls.
Mitigations to verify
There is no single fix, so testing should confirm defense in depth. The strongest controls constrain what the model is allowed to do and validate everything on the way out, rather than relying on the model to resist manipulation.
- Enforce least privilege on tools and integrations so a manipulated model cannot take high-impact actions.
- Require human approval for consequential operations such as sending funds, deleting data, or executing code.
- Validate and encode model output before it reaches any downstream sink to prevent XSS, injection, or SSRF.
- Segregate and label untrusted content, and constrain the model with clear boundaries rather than trusting instructions alone.
Reporting prompt injection findings
A useful report distinguishes the injection from its impact. Demonstrating that a model can be made to say something is weak; demonstrating that injection leads to data disclosure, an unauthorized action, or a downstream vulnerability such as XSS is what drives remediation.
Map each finding to OWASP LLM01, note the relevant MITRE ATLAS technique where applicable, provide the exact payload and the affected source or sink, and recommend the specific containment control that closes the impact path.
Related
FAQ
Can prompt injection be fully prevented?
Not reliably today. Current LLMs do not cleanly separate trusted instructions from untrusted data in the same context, so prompt injection is contained through defense in depth, least privilege on tools, human approval for high-impact actions, and strict output handling, rather than eliminated by a single control.
Which is more dangerous, direct or indirect prompt injection?
Indirect injection is usually the greater risk in deployed systems because the attacker hides instructions in content the model later reads, such as a web page or document, and never interacts with the application directly. This scales to any user who processes the poisoned content.
Where does prompt injection sit in the OWASP LLM Top 10?
Prompt injection is LLM01, the top-ranked risk in the OWASP Top 10 for LLM Applications, reflecting how common and impactful it is, especially when model output is trusted by downstream tools and integrations.