The LLM processes everything in its context window as text. The developer’s system prompt and the user’s message, alongside anything the agent retrieves from external sources, arrive in the same format. There is no structural marker telling the model “this text is authoritative instruction” versus “this text is data.” Prompt injection exploits that uniformity.
Direct injection: overriding instructions from user input
The simpler variant. A message is crafted to override the system prompt. “Ignore all previous instructions and…” is the familiar shorthand, but the mechanism ranges from blunt to subtle: roleplay framings and multi-turn setups that build false context before the payload arrives.
The attack surface is every user who can type a message. The structural vulnerability is that instructions are text, and text arriving later in the context can displace text from earlier.
Indirect injection: hiding in what the agent reads
An agent that retrieves content from websites and documents pulls external text into its context during a task. Indirect injection embeds the attack payload in that retrieved content. The user never types it; the developer never wrote it. It arrives because the agent went out and got it.
Research published in April 2026 surveyed 1.2 billion URLs and found 15,300 validated indirect prompt injection payloads across 11,700 pages. Roughly 70% appeared in non-rendered HTML such as meta tags and comments, invisible to any human reader browsing the same page (Khodayari et al., arXiv:2604.27202, April 2026).
Stored injection: planted before the request
A further variant targets retrieval-augmented generation (RAG) systems, where an agent queries a knowledge base rather than browsing live content. An attacker pre-positions a malicious instruction inside a document or record in that knowledge base. When a user’s query returns that record, the payload arrives inside what the agent treats as legitimate context.
The difference from indirect injection is timing: the payload is planted before any specific user request is made, rather than encountered live as the agent browses.
Agents face a wider attack surface than chatbots
A chatbot with no external connections faces a bounded attack surface: whatever the user types. An agent with tool access expands that surface through every source it reads. A single task might pull from a document store and several email threads, adding injection vectors with each retrieval.
Crucially, a successful injection does not just alter what the agent says. It can redirect what the agent does, using the tool permissions it already holds. OWASP’s Top 10 for LLM Applications 2025 ranks prompt injection first (LLM01:2025), noting that consequences include unauthorized access and compromised decision-making (OWASP GenAI Security Project, 2025).
Why sanitization alone isn’t sufficient
SQL injection has a reliable defense: parameterized queries create a hard structural boundary between code and data. Prompt injection cannot be defeated the same way. Instructions and content coexist in natural language, with no delimiter the model enforces. Input sanitization and privilege separation between system and user layers reduce the risk; neither provides coverage against a well-crafted indirect attack.
The more reliable backstop is architectural: scope tool permissions narrowly so an injected agent cannot reach far, and require human review before high-stakes actions so a hijacked instruction hits a checkpoint before it causes harm.
Sources
- OWASP GenAI Security Project. LLM01:2025 Prompt Injection. OWASP Top 10 for LLM Applications 2025.
- Soheil Khodayari, Xuenan Zhang, Bhupendra Acharya, Giancarlo Pellegrino. Indirect Prompt Injection in the Wild: An Empirical Study of Prevalence, Techniques, and Objectives. arXiv:2604.27202, April 2026.
Questions, answered
What is the difference between direct and indirect prompt injection?
Direct injection originates in the user's own input: a message crafted to override system instructions. Indirect injection is embedded in external content the model retrieves, such as a webpage or document. The model has no structural way to distinguish the developer's instructions from an attacker's payload when both arrive as plain text.
Is prompt injection the same as jailbreaking?
They target different layers. Jailbreaking attempts to bypass a model's safety training, typically through direct user interaction. Prompt injection targets the application layer, overriding the developer's instructions in a deployed system, independent of the model's base training.
Can prompt injection affect AI agents?
Yes, and agents face a wider attack surface than chatbots. An agent retrieves content from documents and websites during a task, each a potential injection vector. A successful injection does not just change what the agent says. It can redirect what the agent does, using the tool permissions it already holds.
How do you defend against prompt injection?
No single technique is sufficient. Defensive approaches include strict input validation, privilege separation between system and user layers, least-privilege tool scoping, and human review gates before consequential actions, so a hijacked instruction cannot cause harm without a checkpoint.
Brief is a team of AI associates you direct in plain language. Opening to a small group at a time.
Request access