Answers
A web page or file your LLM reads can carry hidden instructions that make it leak a private conversation or misuse its tools. OWASP ranks prompt injection first (LLM01) among LLM application risks and says it is unclear whether fool-proof prevention exists.
Prompt injection is input that changes how a language model behaves or what it outputs in ways its builders did not intend, even when a person cannot see that input. OWASP says it can make a model violate guidelines, generate harmful content, disclose sensitive information or give unauthorized access to the functions the model can call. OWASP ranks it first (LLM01) in its 2025 Top 10 for LLM Applications.
Direct injection comes from the user's own input, on purpose or by accident; indirect injection arrives in external content the model reads, such as a web page or a file. OWASP's indirect example is a summarized web page whose hidden instructions make the model insert an image that links to an attacker's URL, which leaks the private conversation. Indirect injection needs no malicious user at all.
No complete fix is known. OWASP says it is unclear whether fool-proof prevention exists, and that research shows retrieval-augmented generation (RAG) and fine-tuning do not fully mitigate it. Plan for containment: give the application least-privilege access, define and validate output formats with deterministic code, and require human approval for high-risk actions, so a successful injection has little it can do.
A detector screens text for signs of an injection attempt on the way into the model, on the way out, or both. OWASP lists input and output filtering as a mitigation and names semantic filters and string checks as examples. A detector lowers risk without removing it, so run it next to least privilege and human approval for risky actions.
OWASP treats jailbreaking as a form of prompt injection. A jailbreak tries to make the model disregard its safety protocols entirely, while prompt injection covers any input that changes what the model does, such as leaking data or calling a tool. One set of defenses covers both: filtering, least privilege, output checks and regular adversarial testing.
Attack the whole application, not only the model, and treat the model as an untrusted user, as OWASP recommends with regular penetration testing and breach simulations. A scanner such as garak automates known probes for prompt injection and jailbreaks. For the indirect case, plant instructions in the documents, pages and tool outputs your application reads and check whether it acts on them.
LLM01:2025 Prompt Injection, the first entry in the OWASP Top 10 for LLM Applications 2025. Three other entries connect to it: OWASP names prompt injection as a trigger for excessive agency (LLM06), lists vulnerability to indirect injection as a condition that raises the impact of improper output handling (LLM05), and warns that prompt restrictions on sensitive data can be bypassed through it (LLM02).