Large language model prompt injection is a technique for manipulating an AI model by placing instructions in its input so it follows the attacker’s intent instead of the intended task. It works through prompt text, retrieved content, or tool input that the model treats as instructions, which can alter outputs, leak data, or trigger unsafe actions.
How Prompt Injection Works in Large Language Models
Prompt injection succeeds when the model cannot reliably separate trusted instructions from untrusted text. The attacker’s content may arrive directly from the user, indirectly from retrieved documents or web pages, or through tool output that the model treats as if it were part of the task specification.
This matters because the model is not “confused” in a human sense, it is following the strongest instruction signal it can infer from the full context. That makes prompt boundaries, instruction hierarchy, and content provenance part of the security model rather than just prompt-writing concerns.
Why Prompt Injection Is Dangerous
The main danger is that a successful injection can change what the model does with authority the user did not intend to grant. That can lead to policy bypass, disclosure of hidden instructions or contextual data, or unsafe downstream actions when the model is connected to tools, memory, or external systems.
In agentic or tool-using systems, the risk increases because the model may not only generate harmful text, but also take real actions. The same weakness can therefore become an abuse path for data extraction, unauthorized operations, or workflow manipulation.
Common Attack Paths and Variants
Direct prompt injection places malicious instructions in the same conversation the user sees. Indirect prompt injection hides instructions in content the model later ingests, such as emails, documents, tickets, web pages, or RAG sources. Multimodal variants can bury instructions in images, markup, or other non-obvious channels.
Tool and retrieval layers are especially important because they can make hostile content look legitimate. If the model is allowed to summarise, transform, or act on retrieved content without strong instruction separation, an attacker can use that trust boundary to redirect the model’s behaviour.
Defensive Boundaries and Control Layers
Defence is strongest when prompt injection is treated as an architecture problem, not just a prompt-tuning problem. Systems need clear instruction precedence, provenance-aware retrieval, bounded tool permissions, output checks before any side effect, and explicit separation between user task data and executable instructions.
Practical teams also test the full chain, not just the model in isolation. For a deeper reference on attack patterns and layered mitigations, see the Prompt Injection Guide and the OWASP LLM Top 10 LLM01 Prompt Injection Guide. Broader LLM hardening guidance is covered in the LLM Security Guide.
Risk and Threat Considerations
Prompt injection is dangerous because the attacker is not trying to break the model’s weights, they are trying to exploit the model’s trust boundary. In systems with retrieval, memory, or tools, that can turn a single malicious string into data exposure, unauthorized action, or persistence across multiple steps.
Failure mechanism: The model treats untrusted text as higher-priority instruction content, then propagates that mistake into outputs, tool calls, or hidden context.
Impact: Organisations can lose confidentiality, trigger unintended actions, or amplify a small content injection into a broader workflow compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API6 — Unrestricted Access to Sensitive Business Flows | Prompt injection can steer AI-driven workflows into unauthorized business actions. |
| Recommendation — Constrain model-triggered workflows so injected instructions cannot reach sensitive business flows. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | Prompt injection exploits weak trust boundaries between untrusted content and executable instructions. |
| IA-5 — Authenticator Management | Injected prompts often target tokens, secrets, or session-bearing material handled by LLM workflows. | |
| Recommendation — Enforce boundary controls that separate untrusted content from instruction-bearing channels. Protect and rotate authenticators and secrets that an LLM workflow can expose or misuse. | ||
| OWASP ASVS | V15 — Secure Coding and Architecture | Prompt injection is primarily an application-architecture failure in how inputs, tools, and trust are composed. |
| Recommendation — Design AI application architecture so untrusted prompt content cannot override trusted control logic. | ||
| MITRE ATT&CK | T1056 — Input Capture | Prompt injection abuses the interpretation of input channels to alter system behaviour. |
| Recommendation — Hunt for malicious input manipulation patterns across user, retrieval, and tool channels. | ||
Practitioner Guidance
Why practitioners should care: Prompt injection is one of the clearest examples of an AI control that fails at the boundary between language and authority. If the system can read, retrieve, or act, then untrusted content handling becomes a security control, not a UX detail.
What to watch for: Treat any system that combines user input, external retrieval, or tool execution as prompt-injection prone until proven otherwise. The highest-risk designs are those that let the model infer when to ignore instructions instead of enforcing that decision in surrounding application logic.
Related resources from NHI Mgmt Group
- Guide: Agentic AI Security Guide
- Why do large language models create prompt injection risk in production applications?
- What is the difference between prompt injection and model theft?
- Should organisations rely on model safety features alone to stop prompt injection?
- What is the difference between prompt injection testing and model adversarial testing?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org