· Hugo Berton
Prompt injection: what it is and how to limit the risk
A prompt injection is an attack in which someone slips instructions into the text an AI model reads, so that it ignores the rules it was given. It is to language models what SQL injection is to databases, and OWASP ranks it first (LLM01) in its 2025 Top 10 for Large Language Model Applications.
Direct and indirect
Direct: the user types the instructions into the chat, for example asking the assistant to ignore its previous instructions and reveal them.
Indirect, and more dangerous: the instructions sit in content the assistant reads on its own, such as an email, a web page or a document. Whoever operates the assistant may never see them.
What it can cost
An assistant that can act (send an email, apply a discount, update a record) can be made to do it for the wrong person. One that has access to internal data can be made to reveal it.
Defences that help
Give the assistant the least access it needs, and keep reading separate from acting.
Require a human click for anything that sends, pays, deletes or changes a price.
Keep instructions and outside content clearly separated in the prompt, and check outputs before they trigger anything.
Test again after every change of model or prompt: no single defence removes the risk entirely.