# Prompt injection

> Prompt injection is an attack where text given to a language model, typed by a user or hidden in a document, overrides the instructions the system was built with.

- Page: https://methodcrew.com/glossary/prompt-injection
- Last updated: 2026-10-28
- Publisher: [The Method Crew](https://methodcrew.com/)

## How it works

A language model reads its instructions and the content it is working on as one stream of text. It has no reliable way to separate rules from the company and words inside an email. So an attacker writes instructions where the model will read them.

[OWASP](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) lists prompt injection first (LLM01) in its 2025 Top 10 for LLM applications and describes two kinds. Direct injection comes from the person typing into the chat, with lines like "ignore your previous instructions". Indirect injection arrives inside content the system reads on its own: a web page, a PDF attached to an inbound email, a CRM note, a support ticket. Indirect injection is the one that matters most for business systems, because the attacker never needs access to your tool.

## How businesses use it

You design against it. The risk grows with what the model can do. A chatbot that only answers from your help center can be embarrassed. An agent that can send email, issue refunds or query a database can be steered into doing those things for someone else.

Every [AI agent](https://methodcrew.com/glossary/ai-agent) we build gets these controls:

- Each tool has only the permissions its job needs, and read access is separate from write access.
- Outside content is marked as data and kept apart from the system instructions.
- A person confirms high-risk actions before they run (see [human-in-the-loop](https://methodcrew.com/glossary/human-in-the-loop)).
- We run known attack patterns against the system before launch and after every prompt change.

## Where it goes wrong

No filter catches every attack as of October 2026. Classifiers catch common phrasings and miss new ones, so a team that relies on one input filter will eventually be surprised. The workable approach assumes some injections get through and limits the damage: narrow tools, approval gates, a log of every tool call, and alerts on unusual behavior. [AI guardrails](https://methodcrew.com/glossary/ai-guardrails) and [LLMOps](https://methodcrew.com/glossary/llmops) monitoring cover the last two.

Match the effort to the exposure. An assistant that reads no outside content and can take no actions carries mostly reputational risk, and a simple setup is fine.

## Example (hypothetical)

Hypothetical: an inbox agent summarizes supplier emails and can create purchase orders. One email carries white-on-white text telling the model to approve an order to a new bank account; because the agent can only draft orders and a buyer approves each one, the attack ends as a flagged draft.

## Related terms

- [AI guardrails](https://methodcrew.com/glossary/ai-guardrails): AI guardrails are checks placed around a language model that block, rewrite or escalate inputs and outputs that break your rules on safety, accuracy, privacy or scope.
- [Function calling (tool use)](https://methodcrew.com/glossary/function-calling): Function calling lets a language model ask your software to run a named function, such as a CRM lookup, by returning the function name and arguments as JSON.
- [AI agent](https://methodcrew.com/glossary/ai-agent): An AI agent is a language model that chooses and calls tools in a loop, reading each result, until it finishes a task or hands off to a person.
- [Human-in-the-loop (HITL)](https://methodcrew.com/glossary/human-in-the-loop): Human-in-the-loop is a workflow design where a person reviews, corrects or approves an AI system's output at set points before it reaches a customer or a system of record.
- [Model Context Protocol (MCP)](https://methodcrew.com/glossary/model-context-protocol): The Model Context Protocol is an open standard for connecting AI applications to outside tools and data, so a single integration works across compatible assistants and agents.

## Services where this matters

- [AI ops monitoring and improvement](https://methodcrew.com/services/ai-ops-monitoring): Quality checks, cost control and model updates for live AI systems. $1,500 to $5,000 per month.
- [Custom AI agents and copilots](https://methodcrew.com/services/custom-ai-agents): Agents that look things up in your CRM or helpdesk and take the next step, with approvals. $15,000 to $90,000 per project.
- [RAG and knowledge systems](https://methodcrew.com/services/rag-knowledge-systems): Your documents turned into an assistant that cites its sources. $15,000 to $75,000 per project.

## Articles that use this term

- [AI agents vs workflow automation vs chatbots: how to pick](https://methodcrew.com/insights/ai-agents-vs-automation-vs-chatbots)
- [AI readiness assessment: the checklist we use and how to score it](https://methodcrew.com/insights/ai-readiness-assessment-checklist)
- [AI acceptable use policy template for employees](https://methodcrew.com/insights/ai-acceptable-use-policy-template)

Full glossary: https://methodcrew.com/glossary