What is prompt injection?

By Identra · Updated October 3, 2026

Prompt injection is an attack that places instructions in AI input to make the system depart from its intended task or rules. It exploits confusion between content the AI should process and instructions it should follow, potentially causing misleading answers, data disclosure, or unauthorized actions.

Key numbers

Prompt injection is ranked LLM01, the number one risk, for the second consecutive edition of the OWASP Top 10 for LLM Applications (OWASP GenAI Security Project, 2025)
1.8 million attack attempts against 22 anonymized models produced roughly 62,000 successful breaches, and no model was immune to indirect prompt injection (Gray Swan AI and UK AI Security Institute agent red-teaming challenge, 2025)
Direct prompt injection against web agents succeeded more than 79% of the time across all tested configurations. Indirect injection succeeded 41% to 68% of the time (StakeBench benchmark, Nanyang Technological University, IBM Research, and collaborators, 2026)

How does prompt injection work?

An AI application may combine application instructions, a user's request, retrieved documents, and tool results when asking a model what to do. These inputs can have different roles and trust levels. Prompt injection succeeds when the model treats lower-trust content as authority to change its behavior.

A malicious document might claim to contain an urgent administrator directive or ask the assistant to disregard its task. The instruction can be plainly visible. Hidden text is an option for an attacker, not a requirement. The attack also does not have to use familiar phrases such as “ignore previous instructions.”

Message roles and clear delimiters help communicate boundaries, but they do not enforce authorization. Applications must decide separately whether a proposed action is permitted. OWASP's prompt injection guidance describes both direct manipulation and attacks delivered through external content.

What is the difference between direct and indirect prompt injection?

Direct injection comes through input submitted to the AI application. Indirect prompt injection arrives through material the application retrieves or receives during a legitimate task. An attacker may only need control of a document, ticket, or webpage that the assistant reads.

Neither form guarantees success. The result depends on the model, application instructions, available information, and controls around its tools. Indirect delivery matters because an authorized employee can trigger an attack simply by asking the assistant to process attacker-controlled content.

Direct injection
Delivery
Input submitted to the application
Example
A user tells a support chatbot to disregard its refund rules.
Indirect injection
Delivery
Content encountered during a task
Example
A support ticket tells an assistant to retrieve unrelated customer records.

Attack type	Delivery	Example
Direct injection	Input submitted to the application	A user tells a support chatbot to disregard its refund rules.
Indirect injection	Content encountered during a task	A support ticket tells an assistant to retrieve unrelated customer records.

What does prompt injection look like in an enterprise?

Consider a hypothetical support assistant that reads incoming tickets, retrieves customer details, and drafts replies. An attacker submits a ticket claiming that a compliance review requires records from unrelated customer accounts. The ticket instructs the assistant to include those records in its response.

If the assistant follows that instruction and its tools allow broad customer searches, it could retrieve confidential data. If it can also send replies without review, those records could reach the attacker. Even a draft can expose information to an employee who should not see it.

Successful authentication would not make this use legitimate. The assistant would be exercising its access for an attacker's purpose, a confused deputy problem. A safer design restricts retrieval to the customer associated with the ticket and separately checks the recipient and content before sending. The malicious instruction may influence the model while the application still blocks the harmful action.

Why does prompt injection matter for AI agents?

A text assistant can disclose information in its context or produce manipulated advice. An agent with tools can also send messages, modify files, or change business records. Its reachable data and permitted actions determine the potential harm.

Prompt injection does not automatically give an attacker possession of credentials or every permission the agent has. It may instead cause the application to make valid tool calls on the attacker's behalf. Keeping secrets outside model context reduces exposure, but it does not prevent misuse of an authorized tool.

Treat AI agent identity and task authorization as part of the defense. Record whose request an agent is carrying out and constrain access accordingly. Read-only access still carries disclosure risk, while short-lived credentials can still be abused during their valid lifetime.

How do you defend against prompt injection?

Use layered controls that reduce instruction confusion and constrain its consequences. Assign an application owner to enforce the following checks outside the model wherever possible. A system prompt alone is not an access-control mechanism.

Map untrusted inputs, including retrieved files, tool responses, and content passed between agents. Preserve their origin and label them as data.
Apply least privilege to both retrieval and actions. Restrict records, operations, recipients, and destinations to what the current task requires.
Keep credentials out of prompts and retrieved content. Supply them through controlled application code, with narrowly scoped access and appropriate expiration.
Validate tool arguments against application policy. A syntactically valid request can still target the wrong account, file, or recipient.
Require approval for consequential actions. Show the reviewer the actual destination, affected resources, and proposed change. Bind approval to those details.
Inspect inputs and outputs for suspicious instructions and sensitive information. Treat detection as a supporting control that can miss attacks.
Restrict outbound connections and isolate execution environments. Give code-running agents access only to the files and services their tasks need.

How can you tell whether your defenses work?

Test the deployed workflow with its actual retrieval paths and tools. Include attacker-controlled tickets, documents, and tool results. Vary the wording and placement of instructions, and test whether a blocked request can be reformulated. AI red teaming should examine both model behavior and application enforcement.

Define observable outcomes: unrelated records remain inaccessible, unapproved recipients cannot receive data, and consequential actions require valid approval. A model refusing a prompt is useful evidence, but the stronger test is whether the application blocks an unsafe action when the model proposes it.

Maintain an AI audit trail linking the task, retrieved sources, proposed tool calls, approvals, and results. Protect sensitive log contents. If an attack is suspected, pause the affected workflow, preserve relevant evidence, and review completed actions. Revoke credentials when exposure or misuse warrants it, then retest before restoring access.

How Identra thinks about it

Identra limits what a redirected AI agent can do on managed devices. AI agent tool calls are checked against policy before they run, and destructive shell commands can be denied when policy is set to block. In the browser, AI agents driving a session can be detected and blocked by policy. Every endpoint agent run is recorded with the user, device, AI client, and outcome, so teams can review what an agent actually did.

Go deeper: AI security, built on identity

Frequently asked questions

Is prompt injection the same as jailbreaking?

They overlap. Jailbreaking aims to bypass a model's safety restrictions, while prompt injection redirects an application's intended behavior through supplied content. An injection can steal attention from a task or manipulate a business decision without requesting prohibited content.

Can prompt injection be completely prevented?

Do not assume a model or filter can prevent every attempt. Application controls can make specific harmful actions unavailable, such as sending email when no sending capability exists.

Does retrieval-augmented generation prevent prompt injection?

No. Retrieved content can itself contain malicious instructions. Enforce access checks during retrieval and treat retrieved material as evidence to evaluate, not authority to change application policy.

Does an attacker need to steal an agent's credentials?

No. The attacker may persuade the agent to use its existing access for an unintended purpose. Narrow permissions and independent action checks limit what that access can accomplish.

Is an incorrect AI answer evidence of prompt injection?

No. Incorrect answers can result from missing context, bad source material, or model errors. Investigate whether supplied content attempted to redirect the task and whether the system followed it.

Compare

All comparisons →