By FactInfoLive · Published 2026-11-12 · Updated 2026-11-12
The short answer Prompt injection is a way of getting an AI language model to do something its builders did not intend by putting instructions into the text it reads. OWASP, the security community behind the Gen AI Security Project, defines a prompt injection vulnerability as one that "occurs when user prompts alter the LLM's behavior or output in unintended ways." It also notes that these inputs do not need to be visible or readable by a human.
Where the name comes from In a post dated 12 September 2022, the developer Simon Willison described how people were getting GPT-3 to ignore its earlier directions by typing new ones into the input. He wrote that this was not just an academic trick but a form of security exploit, and proposed the name "prompt injection." He explained the cause as prompts being built by concatenating strings, so the developer's instructions and the user's text end up in one block.
Direct and indirect injection OWASP separates two forms. In direct injection, a user's own input changes how the model behaves, whether on purpose or by accident. In indirect injection, the model accepts input from external sources such as websites or files, and that content carries instructions that change its behavior.
The UK National Cyber Security Centre (NCSC) gives an everyday example of the indirect kind: a recruiter's AI tool processes a CV that contains hidden instructions. The attacker never touches the AI system directly; they only write something that ends up being processed. The NCSC says this is commonly called indirect prompt injection.
Why it is not like SQL injection Many people compare it to SQL injection, an older attack on databases. An NCSC blog post from December 2025 argues the comparison can mislead. SQL injection can be properly mitigated with parameterised queries, which keep commands and data apart. The NCSC says current language models "simply do not enforce a security boundary between instructions and data inside a prompt."
Willison made a similar point in 2022 when he wished he could call the model with two separate parameters, one for instructions and one for data. In a 13 April 2023 update to his post he wrote that this fix looks extremely difficult, if not impossible, on the current architecture of large language models.
What defenders are advised to do OWASP's page lists several mitigation measures, including constraining model behavior, filtering inputs and outputs, enforcing least-privilege access, requiring human approval for high-risk actions, and separating external content from trusted instructions. It also recommends adversarial testing.
The NCSC stresses design that does not rely on the model behaving: using deterministic, non-LLM safeguards that limit what the system can do, plus monitoring and logging. It says "make it harder" tricks, such as marking data sections or wrapping external content in tags, can help but should not be treated as a guarantee. It specifically warns against trying to block phrases like "ignore previous instructions."