Classic software separates code and data. LLM applications do not: instructions and content land in the same text, and the model itself decides what it treats as an instruction. Prompt injection exploits exactly that. It ranks first in the OWASP Top 10 for LLM Applications.
Direct and indirect injection
In the direct variant, a user writes instructions into their input, for example to bypass system rules or extract confidential information from the prompt. The indirect variant is more dangerous: the instruction hides in content the model processes on behalf of a harmless user — a web page, a PDF, an email, a document in the RAG index. The model reads the text and follows the hidden instruction without the user knowing.
Why it becomes dangerous
As long as a model only outputs text, the damage is limited. Once it can act through tool calling — sending emails, querying data, changing files, preparing payments — an injected instruction can have real consequences. An AI agent that reads web pages and has access to customer data at the same time is a classic target for data exfiltration.
Why there is no complete solution
No filter reliably detects prompt injection, because instructions in natural language can be phrased in endless ways. Models are becoming more robust, but not immune. Protection therefore does not live in the prompt but in the architecture: assume injection can succeed and limit what may then happen.
Architectural measures
Least privilege: a model gets only the tools and data the specific use case needs. Separation: content from untrusted sources is marked and not combined with privileged actions. Confirmation: consequential actions require human approval. Output control: links, images and data in outputs are checked so that no information leaks via crafted URLs. Tenant boundaries are enforced server-side, not in the prompt. Guardrails, logging and red-teaming as part of evaluation complement this.
For product teams
The most important question for every LLM feature is: what is the worst that happens if an attacker controls the prompt? If the answer is unacceptable, change the architecture, not the prompt. Our checklist on production readiness of LLM features treats this question as a step of its own.