Prompt injection

How it works

A language model reads its instructions and the content it is working on as one stream of text. It has no reliable way to separate rules from the company and words inside an email. So an attacker writes instructions where the model will read them.

OWASP (opens in a new tab) lists prompt injection first (LLM01) in its 2025 Top 10 for LLM applications and describes two kinds. Direct injection comes from the person typing into the chat, with lines like "ignore your previous instructions". Indirect injection arrives inside content the system reads on its own: a web page, a PDF attached to an inbound email, a CRM note, a support ticket. Indirect injection is the one that matters most for business systems, because the attacker never needs access to your tool.

How businesses use it

You design against it. The risk grows with what the model can do. A chatbot that only answers from your help center can be embarrassed. An agent that can send email, issue refunds or query a database can be steered into doing those things for someone else.

Every AI agent we build gets these controls:

• Each tool has only the permissions its job needs, and read access is separate from write access.
• Outside content is marked as data and kept apart from the system instructions.
• A person confirms high-risk actions before they run (see human-in-the-loop).
• We run known attack patterns against the system before launch and after every prompt change.

Where it goes wrong

No filter catches every attack as of October 2026. Classifiers catch common phrasings and miss new ones, so a team that relies on one input filter will eventually be surprised. The workable approach assumes some injections get through and limits the damage: narrow tools, approval gates, a log of every tool call, and alerts on unusual behavior. AI guardrails and LLMOps monitoring cover the last two.

Match the effort to the exposure. An assistant that reads no outside content and can take no actions carries mostly reputational risk, and a simple setup is fine.