Prompt injection is an attack pattern where malicious instructions are placed in prompts, data, or tool outputs to steer a large language model away from the intended task. It works by exploiting the model’s tendency to follow higher-priority or hidden instructions, which can cause unsafe output, tool misuse, or unauthorised data exposure.
What prompt injection actually does
Prompt injection is dangerous because it does not need to break the model itself, it only needs to place convincing instructions where the model will read them. That makes the attack pattern effective across direct prompts, retrieved documents, web content, emails, tool outputs, and other untrusted inputs that the system may treat as instruction-bearing.
In practice, prompt injection is often less about “getting a weird reply” and more about steering the system’s decision path. When the model starts treating attacker-supplied content as higher priority than the original task, it can ignore guardrails, change its behaviour, or expose data that the user never meant to share.
How prompt injection works across prompts, data, and tools
The core failure is instruction confusion. The model receives ordinary task text alongside hidden or malicious instructions, then follows the wrong hierarchy. That can happen in a single chat turn, through a poisoned document, through retrieval-augmented generation content, or through a tool response that the model mistakenly treats as authoritative.
This is why prompt injection is especially relevant in systems that let models read outside context, search the web, call tools, or operate on behalf of a user. The attack surface is not just the prompt box, it is any channel that can feed text back into the model’s working context, including logs, tickets, web pages, code comments, and form submissions.
NHIMG’s Prompt Injection Guide covers the main attack variants, including direct, indirect, and multimodal prompt injection, along with layered defences.
Why prompt injection is especially risky for AI assistants and agents
Prompt injection becomes more serious when the model can take actions, not just generate text. Once the system has tool access, the attacker is no longer trying to influence wording alone, but to influence execution, data access, or external side effects.
That is why prompt injection often overlaps with tool misuse, unsafe automation, and unauthorised disclosure. A compromised instruction stream can cause an agent to search sensitive data, send data to the wrong destination, run an unintended command, or widen its own access path by persuading a downstream tool or sub-agent to comply.
For agentic systems, the best-known reference point is OWASP Agentic AI Top 10, which treats prompt injection as part of a broader set of instruction and privilege abuse risks.
NHIMG’s Agentic AI Security Guide is useful when you need to understand how prompt injection interacts with memory, tools, orchestration, and identity in autonomous systems.
Common failure modes and what they can expose
Prompt injection can lead to different outcomes depending on what the model is allowed to see and do. The most common failure modes are unsafe output, leaked context, tool misuse, policy bypass, and execution of attacker-supplied instructions that were never meant to be trusted.
The security impact is usually driven by the model’s placement inside a larger workflow. If the model has access to confidential context, the attack can become a data exposure issue. If it can invoke tools, the same attack can become an action integrity issue. If it sits inside an orchestration layer, the attacker may influence downstream systems without ever attacking them directly.
NHIMG’s EchoLeak (Microsoft 365 Copilot) 2025 shows how a crafted message can drive zero-click context leakage, while Gemini CLI prompt injection flaw 2025 shows how poisoned content can push an AI tool toward hidden commands and secret exposure.
Other real-world examples, such as ForcedLeak (Salesforce Agentforce) 2025, demonstrate that indirect prompt injection can turn ordinary inbound content into a data exfiltration path.
How to evaluate and contain exposure
Exposure assessment starts with identifying every place untrusted text can enter the model’s context. That includes user prompts, retrieved documents, web pages, emails, tickets, code, and tool outputs. Once those paths are mapped, the next question is which of them can influence high-value actions or sensitive data access.
Containment is strongest when systems separate instructions from data, restrict tool authority, and assume that retrieved or external content may be adversarial. The practical goal is not to trust the model more, but to trust less of what it reads unless the architecture has explicitly validated the source and bounded the action.
For deeper threat modelling, MITRE ATLAS adversarial AI threat matrix is a useful reference for prompt injection, context poisoning, and related adversarial techniques.
Where organisations are building or reviewing broader controls, NIST SP 800-53 Rev 5 Security and Privacy Controls provides a control baseline for access control, auditability, and system integrity.
Risk and Threat Considerations
Prompt injection is risky because the attacker only needs to influence the model’s context, not compromise the model’s weights or infrastructure. In systems with retrieval, memory, or tool access, that can turn a single malicious string into data exposure, unsafe actions, or policy bypass.
Failure mechanism: The model misclassifies attacker-controlled text as trusted instruction content, then follows it over the user’s intended task or system policy.
Impact: The result can be context leakage, tool misuse, unauthorised side effects, or secondary compromise of connected systems that the model can reach.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Prompt injection steers agent goals away from the intended task. |
| ASI02 — Tool Misuse | Prompt injection can coerce agents into harmful tool calls and unsafe actions. | |
| ASI03 — Identity & Privilege Abuse | Prompt injection becomes more severe when it can abuse delegated authority or credentials. | |
| Recommendation — Bind agent instructions to trusted sources and detect goal hijack attempts in context. Restrict tool permissions and validate every tool invocation against policy. Constrain agent authority and separate identity-bearing access from untrusted instructions. | ||
| MITRE ATT&CK | T1204 — User Execution | Prompt injection relies on user or system execution of attacker-supplied instructions. |
| T1059 — Command and Scripting Interpreter | Injected prompts can drive hidden command execution through agent tools or shells. | |
| Recommendation — Hunt for social or content-based execution paths that trigger malicious instructions. Monitor for unexpected command generation and block unsafe interpreter reachability. | ||
Practitioner Guidance
Why practitioners should care: Prompt injection should be treated as a system-design problem, not a content-moderation problem. If an AI assistant can read untrusted text and act on it, the architecture has already created an abuse path.
What to watch for: Pay close attention when the model can access private context, invoke tools, or pass outputs to another automated step. Those are the conditions that turn instruction confusion into a real security incident.
Practitioner takeaway: The safest designs minimise the model’s trust in external text and minimise the model’s authority over actions, especially where hidden instructions can flow in from retrieval or tool output.
Related resources from NHI Mgmt Group
- Where does Azure OpenAI prompt injection protection fail in practice?
- How should organisations govern prompt injection risk across Azure OpenAI agents?
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between prompt injection and credential theft for agents