Prompt Injection Explained: The Top Risk in AI Applications

Companies are adding AI assistants to websites, support desks and internal tools. Those assistants follow instructions written in plain language, and that creates a new kind of attack: prompt injection. It is the first entry in the OWASP Top 10 for LLM Applications, and one of the most common findings in AI application tests.

What Prompt Injection Is

An AI application combines its own instructions (the system prompt) with text from users, documents or websites, and sends it all to a large language model (LLM). The model cannot reliably tell trusted instructions from untrusted text. Prompt injection is crafting input so the model follows the attacker's instructions instead of the developer's.

Direct Prompt Injection

The attacker types the instructions themselves, for example asking a support bot to ignore its rules and reveal its hidden instructions, or to give a discount it should not. Often the effect is embarrassing rather than dangerous, unless the assistant has access to data or actions.

Indirect Prompt Injection

More serious. The instructions are hidden in content the AI reads on the user's behalf: a web page it summarizes, an email in an inbox it manages, a document in its knowledge base. The user never sees them. If the assistant can send emails, query databases or call tools, hidden instructions can make it leak data or take actions the user never asked for.

Why It Is Hard to Fix

There is no complete fix today, because the model processes instructions and data in the same channel. Filters that block known phrases are easy to bypass with rewording or other languages. So defenses focus on limiting damage:

• Give the assistant the least access it needs, especially to tools and data
• Require a person to approve sensitive actions
• Treat model output as untrusted: validate it before it reaches a database, browser or shell
• Keep untrusted content clearly separated and labeled
• Log and monitor prompts and actions for misuse

The OWASP Top 10 for LLM Applications (2025)

• LLM01 Prompt injection
• LLM02 Sensitive information disclosure
• LLM03 Supply chain
• LLM04 Data and model poisoning
• LLM05 Improper output handling
• LLM06 Excessive agency
• LLM07 System prompt leakage
• LLM08 Vector and embedding weaknesses
• LLM09 Misinformation
• LLM10 Unbounded consumption

This is the 2025 edition from the OWASP Gen AI Security Project, still the current one when this guide was written in October 2026. Check genai.owasp.org for updates.

How Testers Check an AI Feature

• Map what the assistant can see (data, documents) and do (tools, actions)
• Try direct injection to extract instructions or bypass rules
• Plant instructions in content the assistant will read, in a test environment
• Check whether output is rendered unsafely, for example as HTML in a browser
• Report impact in terms of data and actions, not clever prompts

Learning AI Application Security

Our Application Security course has a module on AI application security, where you test an intentionally vulnerable chat assistant with a knowledge base and tools. Read will AI replace cybersecurity jobs for why this skill matters.