Prompt Injection Explained: 7 Defences That Reduce the Risk

Prompt injection is the security problem that follows AI assistants everywhere they go. It happens when text a language model reads changes what the model does, overriding the instructions its owner gave it. As chatbots gain the ability to browse, read email and take actions, the consequences have moved from odd answers to leaked data and unwanted actions.

Updated September 2026.

What prompt injection actually is

A large language model receives one long stream of text: the developer’s instructions, the user’s request, and any content it has been asked to process, such as a web page or a document. OWASP, which ranks this as the top risk in its 2025 list for LLM applications, describes it as input that alters the model’s behaviour or output in ways nobody intended. The altering text does not even have to be visible to a human reader, as long as the model can parse it.

The root cause is architectural. The UK National Cyber Security Centre put it plainly in December 2025: language models “do not enforce a security boundary between instructions and data”. To the model, a sentence in a customer email and a sentence from its developer are the same kind of thing.

Direct and indirect prompt injection

OWASP separates the problem into two forms, and the difference matters for who is at risk.

• Direct injection is when the person typing into the tool tries to push it past its rules, for example to reveal hidden instructions or produce content it should refuse. The attacker and the user are the same person.
• Indirect injection is when the instructions arrive inside content the model processes on someone else’s behalf: a web page, a shared file, an email, a product review, or text hidden in an image. The user never sees the instruction, but the assistant acting for them does.

Indirect injection is the more serious of the two, because the victim did nothing unusual. They asked an assistant to summarise a page or sort their inbox, and the content itself carried the attack. NIST’s Center for AI Standards and Innovation calls the agent version of this “agent hijacking”: instructions planted in data an AI agent will ingest, causing it to take harmful actions.

It can also happen by accident. OWASP notes cases where ordinary content, such as a CV written to game automated screening, changes a model’s judgement without anyone intending an attack.

Why prompt injection is not like SQL injection

Older injection flaws had clean fixes. SQL injection became manageable once developers could keep commands and user data in separate channels. The NCSC argues no equivalent exists for language models, because there is no separate channel to put the untrusted text in, and it recommends that organisations focus on reducing the likelihood and impact of an attack rather than expecting a patch.

Research backs up that caution. In a January 2025 evaluation, NIST found that letting an attacker retry mattered a great deal: across five hijacking tasks, the average success rate rose from 57 percent on a single attempt to 80 percent when each attack was tried 25 times. In March 2026, NIST reported on a large red-teaming competition run with Gray Swan and the UK AI Security Institute, with more than 400 participants making over 250,000 attack attempts against 13 frontier models. At least one successful attack was found against every model tested.

What an attack can do

The damage depends almost entirely on what the model is connected to. A chatbot with no tools can only say the wrong thing. An assistant with access to your accounts can do the wrong thing.

• Leak information from the conversation, connected files or earlier context to somewhere the attacker can read it.
• Take actions the user never asked for, such as sending messages, changing settings or making requests with the user’s credentials.
• Distort answers, for instance steering a summary, a search result or a hiring recommendation in a chosen direction.
• Poison memory, where an assistant that stores notes between sessions carries a planted instruction forward.

7 defences that reduce prompt injection risk

None of these is a complete fix on its own. Used together, they shrink both the chance of success and the harm a successful attack can cause. They draw on the OWASP and NCSC guidance.

1. Give the model the least access it needs. Scope tokens and tools narrowly. A summariser does not need permission to send email.
2. Require human approval for high-impact actions, such as payments, deletions, sharing files externally or changing account settings.
3. Label untrusted content clearly. Mark where external text starts and ends so the model and any downstream checks treat it as data. This makes attacks harder but does not make them impossible.
4. Check outputs with ordinary code. Validate that responses match an expected format and that proposed actions fall within fixed rules the model cannot talk its way around.
5. Restrict where data can go. Limit the destinations a tool can reach, so a hijacked assistant has nowhere useful to send what it finds.
6. Log and monitor. Record inputs, outputs and tool calls so unusual behaviour is noticed and can be investigated.
7. Test adversarially and keep testing. Treat the model as an untrusted user in penetration tests, and repeat attacks many times, since a single failed attempt proves little.

What everyday users can do

Most people will meet this attack through assistants rather than code. Be cautious about letting an assistant act on content from strangers, such as unknown websites or unsolicited email, and read confirmation prompts rather than clicking through them. Our guides to using AI browser agents safely and what to allow an AI agent to do with your email cover the practical settings. When an answer matters, check the AI answer against a primary source, because a manipulated summary looks exactly like an honest one. For the bigger picture of how these assistants work, see what an AI agent is.

Common questions

What is prompt injection in simple terms? It is when text a language model reads, whether typed by a user or hidden in a web page, email or file, overrides the instructions the model was given and makes it behave in ways its owner did not intend.

What is the difference between direct and indirect prompt injection? Direct injection comes from the person using the tool. Indirect injection is hidden in content the tool processes for someone else, so the user may never see it. Indirect attacks are more dangerous for assistants that take actions.

Can prompt injection be completely prevented? Not with current models, according to the UK NCSC, because they do not separate instructions from data. The practical goal is to reduce the chance of success and limit what a successful attack can reach.

Is prompt injection the same as jailbreaking? Jailbreaking is usually a form of direct injection aimed at getting around a model’s safety rules. Injection is the wider category, including instructions hidden in third-party content.

Sources and further reading

Where the figures and rules above come from, so you can check them:

• LLM01:2025 Prompt Injection, definitions and mitigations: OWASP GenAI Security Project
• Prompt injection is not SQL injection (December 2025): UK National Cyber Security Centre
• Strengthening AI agent hijacking evaluations (January 2025): NIST CAISI
• Insights from a large-scale AI agent red-teaming competition (March 2026): NIST CAISI

Photo credits: CSS code on a screen (Unsplash) by Sai Kiran Anagani _imkiran, CC0, via Wikimedia Commons. Smartphone with ChatGPT on keyboard (52917311050) by Jernej Furman from Slovenia, CC BY 2.0, via Wikimedia Commons.