WTF is prompt injection?
Short version
Prompt injection is when text an AI reads tricks it into following an attacker instead of you.
The briefing
- OWASP rank
- LLM01, the top entry in its 2025 list for large language model applications.
- The cause
- Models get instructions and data as one stream of natural language, with no clear line between them. Orders and mail arrive on the same radio channel.
- Direct injection
- Someone types the attack straight into the prompt.
- Indirect injection
- The dangerous one for developers. The attack hides in something the model reads: a web page, an email, a file, a code comment, an issue or a commit message.
- You may never see it
- OWASP notes the input does not need to be human-readable as long as the model parses it. Its examples include white text on a white background and non-printing Unicode characters.
- What is at stake
- A tricked chatbot says something silly. A tricked coding agent has your shell, your files and your tools. Hidden instructions in a README can steer it toward your secrets or commands you would never approve.
- No silver bullet
- OWASP says it is unclear if there are fool-proof methods of prevention, and that screening input is not a security boundary.
In the Threat Brief this looks like:
Indirect prompt injection in ExampleAgent: a crafted README can steer it toward local secrets.
The attack is in the text, not in your prompt. Your agent only had to read the file.
Example only. The product, versions and names are made up.
What to do
- Plan on it happening.
- Limit what the agent can touch.
- Keep a human approval on risky actions.
- Treat anything it reads or gets back from a tool as untrusted.