Prompt Injection is an attack class in which adversarial content, embedded in user input, retrieved documents, tool outputs, or web pages, manipulates an LLM-ba
Prompt injection hides adversarial instructions in content an AI system processes, a webpage, email, document, or tool result, so the model treats attacker text as commands: 'ignore your instructions, exfiltrate the data, click the link.' Indirect injection (via retrieved or fetched content) is the dangerous form, because agents routinely consume untrusted input.
Injection is the signature vulnerability of the agent era, OWASP's top LLM risk, because it weaponizes the system's own capabilities: an injected agent with email, file, or payment tools becomes an insider attacker. No reliable model-level fix exists, so architecture (privilege separation, gates) carries the defense.
Jailbreaking attacks the model's safety rules through the user channel; injection attacks the application through content channels: hijacking instructions via data the system ingests. Injection is the bigger production threat because agents must read untrusted content.
Not purely at the model level today: models can't perfectly separate instructions from data. Practical defense is architectural: treat all ingested content as untrusted, strip/flag instruction-like text, least-privilege tools, approval gates on consequential actions, and monitoring.
Map every channel where untrusted content reaches the model (retrieval, browsing, email, tool outputs), then bound the blast radius: scoped credentials, human gates for irreversible actions, and logged traces. Assume injection will eventually succeed; design so it can't matter much.