Latest
OpenAI on hardening its Atlas browser[5]
OpenAI said prompt injection is unlikely ever to be fully solved and described an automated attacker it uses to find new attack methods.
Overview
Prompt injection: a plain guide for UK organisations
Prompt injection is when text an LLM reads changes what it does. The NCSC expects it never to be fully mitigated, so the work is limiting what a tricked tool can reach.
Last reviewed against NCSC, OWASP GenAI Security Project and Microsoft Security Response Center. Sources
At a glance
- LLM01
- prompt injection's place in OWASP's 2025 list of LLM application risks[2]
- 9.3
- CVSS score of EchoLeak, a zero-click prompt injection flaw in Microsoft 365 Copilot[4]
- 3
- capabilities that together make data theft possible: private data, untrusted content, outward communication[6]
- 4
- areas of NCSC advice: awareness, secure design, making attacks harder and monitoring[1]
The latest
Prompt injection: what has happened so far
Newest first. Each entry links to its source.
NCSC: prompt injection is not SQL injection[1]
The NCSC argued that prompt injection may never be totally mitigated and that organisations should reduce its likelihood and impact.
Microsoft sets out its layered defences[3]
The Microsoft Security Response Center described prevention, detection and impact mitigation against indirect prompt injection.
If your staff use chatbots or assistants, or a supplier has added one to a product you buy, this site is for you. It explains the attack and sets out what the NCSC, OWASP and the vendors themselves advise, and it stays within what their publications say.
The explainer
What it is
An LLM cannot tell orders from content
A language model receives one stream of text. Developers put their own instructions and outside material in the same prompt, and the NCSC says nothing in today's LLMs reliably tells the two apart [1]. Text that reads like an instruction can therefore be obeyed.
Two routes in
OWASP separates direct injection, where a user's own input changes the model's behaviour, from indirect injection, where instructions are tucked into a page, email or document the model is asked to read [2]. The guide to the two forms covers both.
Not always visible
OWASP notes that injected text can be invisible to people, provided the model still parses it [2]. Staff reviewing a document may see nothing odd.
What changed
Why it matters now
Assistants are being connected to mail, files and tools, and that is where injection does harm. In June 2025 a zero-click flaw in Microsoft 365 Copilot, CVE-2025-32711, was reported with a CVSS score of 9.3 [4]. Microsoft had already fixed it and said customers needed to do nothing [4]. The EchoLeak case shows how an ordinary email became the attack.
Vendors now speak plainly about the limits. The NCSC's December 2025 view is that a complete cure, of the kind SQL injection got, may never arrive for this attack [1]. OpenAI took a similar line on its Atlas browser, calling the problem unlikely to be fully "solved" [5].
Where to start
Your first move
Pick one AI tool and run the three-question checker below. Then read the risks and follow the quarterly plan. Short answers are on the questions page.
What to do
Four things to do first
-
1
Find where untrusted content reaches an LLM
IT and security leads
-
2
Test each tool against the three risky capabilities
Security architects and product owners
-
3
Cut the tool's reach to match the least trusted content it reads
Development and security teams
-
4
Put approval and fixed rules outside the LLM
Product owners and system owners
There are eight steps in all, with who does each one. See every step
Am I affected?
Answer a few questions
Check if you are affected
Quick answers
Questions people ask
What is prompt injection?
It is text that makes an LLM act or answer differently from what its owner planned[2]. The effects can include leaked data, harmful content, unauthorised access or manipulated decisions[2].
Is prompt injection the same as SQL injection?
No. The NCSC points out that parameterised queries cure SQL injection, while an LLM has no firm line between instructions and data[1]. It argues the comparison can lead teams to the wrong defences[1].
Can prompt injection be fixed?
Probably not completely. The NCSC doubts a total mitigation will ever exist[1], and OpenAI calls the problem unlikely to be fully solved[5]. The aim is therefore to make attacks rarer and less costly.
What is the difference between direct and indirect prompt injection?
Direct injection comes from a user's own input. Indirect injection is hidden in external content the model processes, such as a web page or file[2].
About this site
Primary sources, dated
The CyPro Consulting Ltd team maintains this site. Every version, date and figure comes from 7 named sources, including NCSC, OWASP GenAI Security Project, Microsoft Security Response Center, and links to the one it came from. Last checked 4 November 2026.
Who we are and how pages are kept currentStart here
The guides, in the order to read them
Risks
The risks prompt injection creates for UK organisations: data leaks, unwanted actions and over-trusted tools, with NCSC, OWASP and vendor evidence.
Read the guide
Plan
A practical prompt injection plan for UK organisations: map untrusted content, limit tool access, add approvals, keep logs and test, in order.
Read the guide
Questions
Short, sourced answers on prompt injection: what it is, whether it can be fixed, how it differs from SQL injection and what UK teams should do first.
Read the guideGo deeper
In depth Examples 
In depth Direct vs indirect 
In depth Lethal trifecta 
In depth Vs SQL injection 
In depth Prevention 
In depth EchoLeak case 
Question What is it? 
Question Can it be fixed? 
Question Do filters work? 
Question Detecting it How CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
Prompt injection only shows up when someone tries it against your own tools. Penetration testing can probe the AI features you run or build, to see what a hostile instruction could reach.