Prompt injection: your questions answered

It is text that makes an LLM act or answer differently from what its owner planned[2]. The effects can include leaked data, harmful content, unauthorised access or manipulated decisions[2].

No. The NCSC points out that parameterised queries cure SQL injection, while an LLM has no firm line between instructions and data[1]. It argues the comparison can lead teams to the wrong defences[1].

Probably not completely. The NCSC doubts a total mitigation will ever exist[1], and OpenAI calls the problem unlikely to be fully solved[5]. The aim is therefore to make attacks rarer and less costly.

Direct injection comes from a user's own input. Indirect injection is hidden in external content the model processes, such as a web page or file[2].

It was CVE-2025-32711, a zero-click prompt injection flaw in Microsoft 365 Copilot found by Aim Security and rated 9.3[4]. Microsoft had already addressed it, said customers needed to take no action and no malicious exploitation was seen[4].

It is a risky mix in one tool: it can see private data, it reads content from outsiders and it can send information out[6]. Take away any one of the three and the route to data theft closes.

They can help but are not a full answer. The NCSC advises being wary of vendors who claim to stop it, and warns that blocklists of wording are easy to get around[1]. OWASP says no method is foolproof[2].

List each AI tool and the outside content it reads[2]. Then cut its privileges, add approval for high-risk actions and start logging inputs, outputs and tool calls[1].

Yes. It published guidelines for secure AI system development on 27 November 2023, covering design, development, deployment and operation[7]. Its December 2025 blog post covers prompt injection specifically[1].

OpenAI advises limiting logged-in access, reading confirmation requests and giving agents narrow instructions[5]. It also accepts that letting the browser act on a user's behalf widens the attack surface[5].