LLM prompt injection is an attack that uses crafted input to override or redirect a model's intended behaviour. It becomes dangerous when the model can call tools, access data, or trigger actions, because the injected instruction can turn into a real operational change.
Expanded Definition
LLM prompt injection is a manipulation technique that exploits the instruction-following behaviour of a large language model by embedding adversarial text in a prompt, document, message, or tool output. The goal is not simply to confuse the model, but to redirect its interpretation of priorities so it treats attacker-authored content as more important than the system’s intended instructions. In practice, the risk becomes materially higher when the LLM is connected to retrieval, external tools, workflows, or privileged data sources, because the model can convert a misleading instruction into an action.
This term sits at the intersection of AI security and operational control design, and its meaning is still evolving across vendors and product categories. The most useful reference point is the governance view in the NIST AI Risk Management Framework and the implementation guidance in the NIST AI 600-1 Generative AI Profile, both of which emphasise managing model behaviour, context, and downstream risk. Prompt injection is distinct from ordinary jailbreak attempts because it often rides inside legitimate-looking content that the model is expected to process.
The most common misapplication is treating prompt injection as a purely content-safety problem, which occurs when organisations ignore tool access and data exposure in connected agentic workflows.
Examples and Use Cases
Implementing defences against prompt injection rigorously often introduces friction in retrieval, summarisation, and automation flows, requiring organisations to weigh model usefulness against stricter context filtering and tool gating.
- A support assistant reads a customer email that includes hidden instructions telling the model to ignore policy and reveal internal notes.
- A retrieval-augmented generation system ingests a poisoned document that instructs the model to prioritise attacker-approved answers over trusted sources.
- An agent with mailbox access is tricked by a crafted message into sending data to an external address or opening a dangerous link, a risk category reflected in the OWASP Top 10 for Agentic Applications 2026.
- A code assistant receives repository comments or issue text containing adversarial instructions that steer it toward unsafe code changes or secret exposure.
- A workflow agent interprets a malicious tool response as a higher-priority instruction and takes an action the user never authorised.
These scenarios are closely related to adversarial AI threat patterns described in the MITRE ATLAS adversarial AI threat matrix, where the attacker exploits model inputs rather than breaking the underlying infrastructure directly.
Why It Matters for Security Teams
Prompt injection matters because it undermines trust in model outputs, and in connected systems that trust can become a control failure. Security teams need to understand that the danger is not limited to incorrect text generation. Once a model can query internal systems, trigger workflows, or handle secrets, a successful injection can become an authorisation bypass in practice, even when the surrounding application appears properly secured.
For AI governance, this means defensive design has to include input separation, tool permission scoping, output validation, and human approval for high-impact actions. Frameworks such as the OWASP Agentic AI Top 10 and the CSA MAESTRO agentic AI threat modeling framework both point toward the same operational lesson: prompts, retrieved content, and tool outputs should not be treated as equally trustworthy.
Organisations typically encounter the business impact only after an agent has already misrouted data, executed an unsafe tool call, or leaked internal context, at which point prompt injection becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | Defines AI risk governance practices for managing prompt-related model risk. | |
| NIST AI 600-1 | Profiles generative AI risks, including unsafe model behavior from manipulated inputs. | |
| OWASP Agentic AI Top 10 | Covers agentic app threats where injected prompts can drive tool misuse. | |
| MITRE ATLAS | Catalogs adversarial AI attack techniques relevant to prompt injection patterns. | |
| CSA MAESTRO | Provides threat modeling guidance for agentic AI systems exposed to prompt attacks. |
Design agent guardrails, permission checks, and human approvals around every tool action.
Related resources from NHI Mgmt Group
- What is the difference between prompt injection and LLM remote code execution?
- How should security teams handle prompt injection in production LLM applications?
- How should security teams control browser prompt injection risk in LLM tools?
- Why do static LLM controls fail against indirect prompt injection?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
