Open prompt injection is a technique that places malicious instructions in content an AI system reads and follows. It works when an assistant, agent, or retrieval pipeline treats untrusted text as higher priority than its system instructions or task boundaries, causing policy bypass, data leakage, or unauthorised tool use.
What Open Prompt Injection Is
Open prompt injection is dangerous because the malicious text does not need to look like code or a traditional exploit. It can be embedded in emails, documents, webpages, tickets, code comments, or retrieval results, then surfaced when a model or agent consumes that content as if it were trusted instructions. That makes the attack unusually portable across assistants, tools, and workflows.
How Open Prompt Injection Works
The core failure is instruction confusion: the model is asked to treat untrusted content as input, but the malicious content is crafted to read like a higher-priority command. In agentic systems, that can redirect planning, change tool usage, or alter what the system says or does. The issue is not the text itself, but the fact that the surrounding application fails to enforce strong boundaries between content, instructions, and actions. Prompt Injection Guide
Open prompt injection is especially effective where assistants summarize, classify, retrieve, or act on third-party content. A poisoned paragraph can be enough to influence an assistant’s next step, and in some systems the payload can survive through multiple layers, such as retrieval, memory, tool invocation, and output generation. That is why prompt injection is best understood as a control-boundary problem, not just a wording trick.
Where the Attack Surface Comes From
The attack surface expands whenever the system reads content it did not author and then gives that content decision-making influence. Common examples include document ingestion, web browsing, RAG pipelines, customer support chats, code assistants, and workflow agents. The more authority the system has over downstream tools, the more damaging a successful injection becomes. Top 10 LLM Deployment Mistakes
Open prompt injection is also dangerous because the injected instruction can aim for outcomes that look like normal model behavior: leak context, reveal hidden prompts, ignore rules, or call tools in an unsafe order. In practice, that means the attacker is often trying to turn a benign AI feature into a trust bypass, data-exfiltration path, or unsafe automation channel.
Why It Matters for Security Outcomes
When open prompt injection succeeds, the impact can include policy bypass, disclosure of sensitive context, unwanted disclosure of secrets, unauthorized tool execution, or abuse of connected systems. The harm is often indirect, because the model may appear to be merely following instructions while actually crossing a boundary that the application was supposed to enforce. OWASP LLM Top 10 LLM01 Prompt Injection Guide
That is why prompt injection should be treated as a systemic security issue rather than a single model quirk. Once an assistant can read untrusted content and act on it, the question becomes how much trust, privilege, and context that content is allowed to influence.
Risk and Threat Considerations
Open prompt injection creates a durable risk because the attacker can place malicious instructions in ordinary content channels that defenders already accept into the system. The danger increases when the model has access to private context, internal tools, or write-capable integrations, because the injected text can steer the system toward disclosure or misuse without breaking the application in an obvious way.
Failure mechanism: The application fails to keep untrusted content separate from instructions, so the model gives malicious text operational weight during retrieval, reasoning, or tool use.
Impact: This can produce data leakage, policy bypass, malicious actions through connected tools, or compromise of downstream systems that trust the model’s output.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5, CIS Controls v8 and OWASP ASVS set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI01 — Agent Goal Hijack | Open prompt injection can steer an agent away from its intended goal. |
| ASI02 — Tool Misuse | Injected instructions can trigger unsafe tool calls or tool sequences. | |
| ASI03 — Identity & Privilege Abuse | Prompt injection becomes more severe when agents inherit excessive authority. | |
| Recommendation — Constrain goal interpretation so untrusted content cannot redirect agent objectives. Restrict tool invocation paths and require explicit authorization for risky actions. Reduce agent privilege so compromised prompts cannot access or change sensitive resources. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Prompt injection impact depends on how much privilege the model or agent holds. |
| AU-6 — Audit Review, Analysis, and Reporting | Prompt injection investigations rely on tracing model outputs, tool calls, and context use. | |
| Recommendation — Limit model-linked accounts and tools to the minimum permissions needed. Review AI and tool activity logs for anomalous instruction-following or data exposure. | ||
| CIS Controls v8 | 5 — Account Management | Prompt injection often abuses accounts, tokens, or access paths that were too broad. |
| Recommendation — Inventory and restrict accounts used by AI workflows and connected automations. | ||
| OWASP ASVS | V16 — Security Logging and Error Handling | Detection of prompt injection depends on logging model interactions and failures. |
| Recommendation — Log AI inputs, tool calls, and policy failures to support investigation and review. | ||
| MITRE ATT&CK | T1056 — Input Capture | Prompt injection is a form of malicious input shaping behaviour through text channels. |
| Recommendation — Map hostile content channels and hunt for adversarial input patterns in the pipeline. | ||
Practitioner Guidance
What to watch for: Treat any workflow that reads external text and then acts on it as a boundary enforcement problem. The highest-risk designs are those where the model can both ingest untrusted content and trigger privileged actions, because prompt injection then becomes a path from content ingestion to real-world side effects.
Governance implication: Assign ownership for content boundaries, tool permissions, and action approval separately. If a system can read, summarize, and act, those capabilities should not be controlled as if they were the same thing.
Practitioner takeaway: The safest mental model is that any untrusted text may be adversarial until the system proves otherwise through explicit separation, validation, and constrained action paths.
Related resources from NHI Mgmt Group
- Guide: Agentic AI Security Guide
- Prompt Injection (Agentic)
- What happens when prompt injection is exploited through open-source LLM libraries?
- What is the difference between prompt injection risk and identity abuse in agents?
- What is the difference between prompt injection and credential theft for agents
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org