Definition
What is prompt injection?
It is an attack in which text given to an LLM makes it act or answer in a way its owner never planned.
Last reviewed against NCSC, OWASP GenAI Security Project and Microsoft Security Response Center. Sources
The answer
In one paragraph
OWASP defines prompt injection as inputs that change what an LLM does or says in unintended ways [2]. The result can be disclosure of sensitive data, harmful content, unauthorised access or manipulated decisions [2]. The NCSC calls it an application vulnerability, one that appears when developers put their own instructions and untrusted content into a single prompt [1].
Why it works
One stream of text
An LLM reads its instructions and the material it is given as one sequence. The NCSC says current systems enforce no security boundary within it [1], so a sentence inside an email, a web page or a document can be taken as an order.
OWASP adds that the text need not be visible to a person, as long as the model can read it [2]. That is why a document can look ordinary to the staff member who opens it.
Related terms
Do not confuse these
Jailbreaking
In OWASP's account jailbreaking is a close relative, an injection whose target is a model's safety rules [2].
SQL injection
It sounds similar but the NCSC says the two need different defences, because SQL injection has a proper cure and this does not. See the comparison [1].
Where it ranks
OWASP places prompt injection first, as LLM01, in the 2025 edition of its top risks for applications built on LLMs [2].
Next
Where to go
Learn the two forms, see some documented examples or go to the plan for what to do about it.
Keep reading
Read next
Can it be fixed?
Can prompt injection be fixed? The NCSC and OpenAI both say probably not completely, so the aim is to cut likelihood and impact. What that means for you.
Read the guide
Do filters work?
Do prompt injection filters, deny-lists and detection products work? What the NCSC, OWASP and Microsoft say about their value and their limits.
Read the guide
Detecting it
How to spot prompt injection attempts: what to log, which signals to watch and why failed tool calls matter, based on NCSC and Microsoft guidance.
Read the guideHow CyPro can help
Need a hand planning for this?
Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Plan ahead
Want a plan for your organisation?
Prompt injection only shows up when someone tries it against your own tools. Penetration testing can probe the AI features you run or build, to see what a hostile instruction could reach.