Prompt Injection

How Prompt Injection Works

Language models do not reliably separate instructions from data. Anything placed in the context window, whether a user message, a web page, a document or a tool result, can influence what the model does next. An attacker who controls some of that text can try to steer the model.

• Direct prompt injection. The attacker types the malicious instructions straight into the application, for example asking a support bot to reveal its system prompt.
• Indirect prompt injection. The instructions are planted in content the model processes later, such as a web page, email, code comment or file that an AI assistant is asked to read.

Why Prompt Injection Is Dangerous

The impact depends on what the model can reach. A chatbot with no tools may only produce misleading text. An AI agent that can call APIs, read internal data, send messages or change code can be manipulated into taking those actions on an attacker's behalf. This is why OWASP lists prompt injection first and excessive agency as a separate risk in its Top 10 for LLM Applications.

How to Reduce Prompt Injection Risk

• Limit privileges. Give models and agents only the tools and data they need for the task.
• Treat model output as untrusted. Validate and encode it before it reaches a database, shell, browser or another system.
• Separate untrusted content. Clearly mark external content and avoid mixing it with trusted instructions.
• Require human approval. Put a person in the loop for high-impact actions such as sending data or merging code.
• Test adversarially. Include prompt injection cases in security testing before release.

There is no complete fix today, so defenses are layered around the model rather than relying on the model to refuse.

Prompt Injection and Application Code

Prompt injection becomes a breach when model output flows into ordinary code paths without the usual checks, such as a query built from model output or an action taken without an authorization check. Those downstream flaws are classic injection and access control problems in your own code. Nullify's code security analysis traces untrusted input to dangerous sinks and flags injection and authorization failures in the application code around your AI features. See how Nullify Code Security works.