What is prompt injection?
When data tries to give orders.

Prompt injection is an attempt to change what the model does.

It happens when text or other content presented to a model tries to override the task or steer the output in an unintended way. The content may be deliberate, accidental, visible, or hidden in material the application reads.

It is not the same as an ordinary wrong answer. The important security question is whether an instruction from an untrusted source can cross into the model’s behavior or influence tools and data the application connects to it.

The instruction can come from the user—or from something the system reads.

This matters most when an application gathers information from outside the conversation. The person may ask for a summary, while a page or file contains separate directions intended for the model. The model sees both in context; the application must decide which source has authority.

Images and other media add another path: text may reach a multimodal model through visual recognition even if a person does not notice it. The OWASP GenAI Security Project includes this in its current prompt-injection guidance.

Adding more text to the prompt does not create an access boundary.

Language models process instructions and supplied content together. Labels, delimiters, and clear task prompts can help signal what is trusted, but they do not enforce permissions or guarantee that every injected instruction will be ignored. Adding retrieval or fine-tuning does not remove the risk by itself.

The impact depends on the surrounding application. A chat-only system may produce a misleading response. An agent with access to private records, browsers, file systems, or messaging tools can have a larger blast radius if it acts on an untrusted direction. Model output is a request to the application; it is not authorization.

Hidden instructions are measurable. A single rate is not a universal risk score.

A 2026 arXiv preprint screened 1.2 billion URLs across 24.8 million hosts and reported 15,300 validated prompt-injection instances on about 11,700 pages. In its identified set, the authors found many instructions in non-rendered parts of pages such as headers, comments, or metadata.

The same paper’s controlled experiments used webpage summarization tasks across 13 models and four input representations. Its observed success rates changed with the representation supplied to the model. The authors describe their crawl as a lower-bound estimate and note that detection can miss obfuscated or non-English cases; these measurements should not be read as a general probability that any agent will be compromised.

The practical point is narrower and useful: external content may contain machine-directed instructions that are not obvious in a normal visual review. Test how the complete application handles such content and keep the consequences constrained.

Design for a mistaken interpretation, not a perfect refusal.

OWASP recommends layered mitigation—including least privilege, human approval for high-risk operations, clear treatment of external content, and adversarial testing. It also notes that there is no foolproof prompt-only prevention method. Filters can help, but they should not be the only barrier between an injected instruction and a protected action.

Security lives at the handoff between language and action.

For a system-wide security exercise, read how to red-team an AI system ↗. For the practical permission model, read why permissions belong at the tool boundary ↗. To test an agent’s behavior, see how to evaluate AI agents ↗.