Prompt injection is a security vulnerability in AI systems in which instructions hidden within content that a model processes, such as a webpage, document, email, or search result, are interpreted and followed by the model as if they were legitimate commands, potentially overriding the developer's or user's original intent. The term was coined in 2022 by researcher Simon Willison to describe attacks analogous to SQL injection in traditional software: in both cases, untrusted input is not properly separated from trusted instructions, allowing an attacker to smuggle commands through a channel meant only for data.
Prompt injection became a significantly greater practical concern with the rise of AI agents and tool use, since an agent that can browse the web, read email, or execute code on a user's behalf may encounter attacker-controlled content and act on injected instructions with real consequences, unlike a simple chatbot that only produces text.
Direct versus indirect injection
Security researchers distinguish direct prompt injection, where a user directly types adversarial instructions into a prompt and which overlaps significantly with jailbreaking, from indirect prompt injection, where the malicious instructions are embedded in third-party content that the model retrieves or is given to process, such as a webpage summarized by an assistant, a resume submitted to a hiring tool, or a support ticket handled by an automated agent. Indirect injection is generally considered the more severe risk because the attacker does not need direct access to the AI system at all, only the ability to place content somewhere the system will later read.
Attack examples
Documented and demonstrated attacks include hidden text in a webpage, invisible to a human viewer but readable by the model, instructing an AI browsing assistant to leak private data or take an unintended action; a poisoned document in a retrieval-augmented generation pipeline that causes the model to output false information when that document is retrieved; and malicious instructions embedded in code comments encountered by a coding assistant. Researchers have demonstrated proof-of-concept attacks against commercial AI browsing and agent products, prompting labs to treat the issue as a priority.
Mitigations
Because prompt injection exploits the fact that language models process instructions and data through the same channel of natural-language text, it has no complete technical fix analogous to parameterized queries in SQL. Proposed and partial mitigations include stricter guardrails and output filtering, privilege separation that limits what actions an agent can take without explicit user confirmation, training models to better distinguish trusted system instructions from untrusted retrieved content, and sandboxing tool access. As of 2025, prompt injection remained an unsolved, actively researched problem and a standard topic in AI red teaming exercises, particularly for products built on the Model Context Protocol and similar standards that connect models to external tools and data.