---
title: Prompt Injection — AI Glossary
description: Prompt injection is an attack in which crafted input causes a model to ignore its original instructions and follow the attacker's instead. Because models cannot reliably separate trusted instructions from untrusted data in the same context, malicious text — even hidden in a retrieved document — can hijack behavior.
canonical: https://prompeteer.ai/glossary/prompt-injection
---

# Prompt Injection

Prompt injection is an attack in which crafted input causes a model to ignore its original instructions and follow the attacker's instead. Because models cannot reliably separate trusted instructions from untrusted data in the same context, malicious text — even hidden in a retrieved document — can hijack behavior.

## Definition

Prompt injection exploits the fact that a language model processes system instructions and user or third-party content as one stream of tokens. An attacker embeds directives ("ignore previous instructions and...") in user input or in external content the model reads, potentially causing data exfiltration, unsafe actions, or bypassed guardrails.

Indirect prompt injection, where the malicious instruction lives in a webpage, email, or document the model retrieves, is especially dangerous for agents and RAG systems. Defenses include input isolation, least-privilege tool access, output filtering, and human confirmation for sensitive actions; no single measure is a complete fix.

## Sources

- [OWASP — Top 10 for LLM Applications: Prompt Injection](https://owasp.org/www-project-top-10-for-large-language-model-applications/)
- [Greshake et al. (2023), Not what you've signed up for: Indirect Prompt Injection](https://arxiv.org/abs/2302.12173)

## Related terms

- [jailbreak](https://prompeteer.ai/glossary/jailbreak)
- [guardrails](https://prompeteer.ai/glossary/guardrails)
- [system-prompt](https://prompeteer.ai/glossary/system-prompt)
- [agent](https://prompeteer.ai/glossary/agent)