Prompt injection

Prompt injection hides instructions inside text a language model reads. Whoever controls that text can give the model orders, because the model cannot tell it apart from the operator’s own instructions. Simon Willison named the attack in September 2022.

Direct injection is a user typing instructions that contradict the system prompt. Indirect prompt injection is the dangerous case: the instruction sits in content the model retrieves, so the attacker never has to breach the application and the user never sees the instruction.

Why prompt injection has no clean fix

Prompt injection has no clean fix because the boundary it violates was never there. OWASP states that models make “no architectural distinction between ‘instructions’ and ‘data’”, both being “tokens on the same stream”, so “there is no clean equivalent to parameterized queries.” Nothing in that stream carries a mark the model must respect.

Better prompting therefore cannot close it: an instruction to ignore injected instructions is text in the same channel as the attack. Nor can detection — twelve recent defences, re-tested against attackers who had read them, mostly fell with attack success above 90 percent.

The NCSC frames a language model as a confused deputy that is inherently confusable, so the risk can be reduced and not removed. OWASP agrees: no reliable prevention mechanism exists, so defence is “architectural rather than interceptive”, with least privilege “load-bearing” for agents. What holds is prompt injection mitigations, and for an agent, the lethal trifecta.

Where definitions disagree

Whether jailbreaking is prompt injection is disputed. OWASP says it is, in the 2026 edition and the 2025 one before it: jailbreaking is “the subset of prompt injection where the attacker’s goal is to make the model violate its safety protocols.” Willison, who coined the term, says it is not: with no concatenation of a trusted developer prompt and untrusted input, it is not prompt injection.

This page follows the narrow reading, because the parties and the defences differ. Jailbreaking is the operator pushing on the model’s own safety training; injection is a third party pushing on someone else’s application. Willison’s example of the cost: a detector trained on jailbreaks blocks a request for a napalm recipe and allows an instruction to search a mailbox and forward the results to an attacker.

Questions and answers

Is prompt injection the same as jailbreaking?

Authorities disagree. OWASP's LLM Top 10 treats jailbreaking as the subset of prompt injection where the attacker's goal is to make the model violate its safety protocols. Simon Willison, who coined the term, keeps the two apart, and this page follows him: jailbreaking attacks the safety training inside the model, usually driven by the person operating it, while prompt injection attacks an application that concatenates a trusted prompt with untrusted text, and the attacker is usually someone other than the operator.

Can prompt injection be fixed by better prompting?

No. Instructing a model to ignore injected instructions is itself text in the same channel the attack uses, so it can be overridden the same way. OWASP classes constraining the model in the system prompt as a partial control only, to be paired with privilege controls held in application code. The defences that hold limit what the model is able to do rather than stop the model being fooled.

Is prompt injection the same as SQL injection?

Prompt injection and SQL injection share a shape and not a cure. Simon Willison named prompt injection after SQL injection because both concatenate untrusted input with trusted instructions. The UK's National Cyber Security Centre argues the comparison becomes dangerous past that point: parameterised queries fix SQL injection at its root because a database engine enforces the line between instruction and data, and a language model enforces no such line, so the mitigation has no equivalent.