What is prompt injection?

Prompt injection is an attack in which crafted input causes an AI model to behave or respond in ways its operator did not intend, such as ignoring its instructions, revealing data or taking an unauthorized action.

The input can come from the person using the tool or from content the model reads while doing its job, and it can work even when the malicious instruction is invisible to a human. Prompt injection is not a flaw in one product. It is a consequence of how large language models process text, which is why it now sits at the top of the industry's risk list for AI applications.

For businesses and MSPs, prompt injection is not just a model-security issue. It is part of the broader challenge of governing GenAI use, controlling which AI apps are allowed and protecting sensitive data and workflows from unsafe AI interactions.

Prompt injection is ranked LLM01:2025, the number one risk in the OWASP Top 10 for LLM Applications, 2025 edition. It holds the top spot because it exploits something fundamental about how models work, not something a single patch can fix. A large language model reads instructions and data through the same channel and cannot reliably tell one from the other. When an attacker writes input that looks like a new instruction, the model may follow it, because to the model it is just more text to process. Prompt injection is not typically fixed with a single patch. It requires layered controls around the model, the application, the data it can access and the actions it can take.

According to the OWASP Top 10 for LLM Applications, 2025 edition, a prompt injection vulnerability occurs when user prompts alter the model's behavior or output in unintended ways, and these inputs can affect the model even when they are imperceptible to a human reader. The consequences OWASP lists include disclosure of sensitive information, leaking of system instructions, biased or manipulated output, unauthorized access to connected functions and interference with decisions the model influences. For any business connecting an AI tool to its data or workflows, that makes prompt injection a first-order concern. The risk also grows as models gain agency. A chatbot that only answers questions has limited blast radius, but a model wired to send email, query a database or call other tools can turn a single injected instruction into a real-world action. The more an AI tool can do on an employee's behalf, the more a successful injection can do on an attacker's behalf.

Direct prompt injection happens when the input that manipulates the model comes straight from the person interacting with it. Indirect prompt injection happens when the model ingests external content, such as a webpage or a document, that carries a hidden instruction.

1. Direct injection: an employee or attacker types an instruction into a chatbot telling it to ignore its guidelines and reveal restricted information. The attacker controls the prompt directly and uses it to override the model's intended behavior.
2. Indirect injection: a model summarizing a webpage or email reads a hidden instruction embedded in that content and acts on it. The attacker never touches the prompt, they plant the instruction in something the model will later read.
3. Multimodal injection: an attacker hides an instruction inside an image that accompanies ordinary text. When a model that processes images and text together reads the file, the concealed instruction alters its behavior.

Indirect injection is generally the more dangerous of the two for a business, because it does not depend on a malicious insider. An attacker can plant an instruction in a public webpage, a shared document or an inbound email and simply wait for an AI tool to read it. The employee who triggers the attack is doing ordinary work and has no way to see the hidden instruction, which makes the attack both scalable for the attacker and hard for the organization to attribute.

Prompt injection takes many forms in practice, and the variety is part of what makes it hard to defend against. The same underlying weakness can be reached through a typed message, a poisoned document, a manipulated image or a string of characters that means nothing to a human. Four representative scenarios show the range:

1. Customer support chatbot hijack. An attacker types an instruction telling a support chatbot to ignore previous guidelines and query private data stores. The chatbot follows the injected instruction and returns restricted records. The result is unauthorized access to data the bot should never have surfaced.
2. Webpage summary exfiltration. An employee asks a model to summarize a webpage that contains a hidden instruction. Depending on how the AI tool is integrated and what actions it is allowed to perform, the model may insert a malicious link, trigger an external call or attempt to leak session content. What is at risk is the confidentiality of the session.
3. Resume screening manipulation. An attacker submits a resume with a concealed instruction split across the document. When a model screens the candidate, the combined instruction skews the model toward a favorable recommendation. The integrity of the hiring decision is compromised.
4. Email assistant compromise. An attacker sends an email crafted to inject instructions into an AI email assistant that reads it. The assistant acts on the hidden instruction, accessing or altering message content. Trust in the assistant's output is the casualty.

Traditional injection attacks target a programming flaw. SQL injection sends malicious database commands through an input field that fails to separate code from data. Cross-site scripting (XSS) injects malicious script into a web page that other users then load. In both cases the fix is to validate and escape the input so the system stops treating data as executable code.

Prompt injection is harder to close because there is no clean line to enforce. A language model takes instructions and content in the same stream of text and has no built-in way to mark one as trusted and the other as untrusted. The vulnerability lives in how the model works, not in a coding mistake a developer can correct. That is why defenses rely on layered controls rather than a single patch, and why OWASP treats robust prevention as an ongoing engineering problem rather than a solved one. Techniques such as retrieval-augmented generation (RAG) and fine-tuning can improve a model's relevance or behavior, but they do not eliminate prompt injection risk. In fact, RAG can increase exposure to indirect prompt injection when untrusted external content is retrieved and passed into the model without controls. The practical implication for a business is that prompt injection cannot be fully engineered away at the model layer alone. It has to be contained with controls around the model: limiting what the model can access, checking what goes in and what comes out and keeping a person in the loop for anything sensitive.

No single measure fully eliminates prompt injection, but layered controls reduce its impact. Practical mitigations include:

1. Constrain the model's behavior by defining its role and limits in the system prompt and instructing it to refuse attempts to change those instructions.
2. Validate and filter input before it reaches the model, scanning for content that should not be processed.
3. Filter and validate output before it is shown or passed to another system, so a manipulated response cannot trigger downstream actions.
4. Apply least-privilege access, limiting what functions and data the model can reach to the minimum it needs.
5. Restrict tool and function calling with allowlists, scoped permissions and validation before execution, since injection risk rises sharply once a model can act through connected tools.
6. Require human approval for high-risk actions, keeping a person in the loop before the model can act on sensitive operations.
7. Separate and clearly label untrusted external content so the model treats it as data, not instructions.
8. Run adversarial testing and attack simulations regularly to find weak points before an attacker does.

The common thread across these measures is defense in depth. Because no single control is reliable on its own, the goal is to make a successful injection require defeating several controls at once, and to limit the damage if one does get through. For a business adopting AI tools rather than building them, much of this comes down to vendor questions: ask how a tool separates instructions from content, what it can access and whether sensitive actions require human confirmation.

Prompt injection controls work best when paired with AI governance. That starts with visibility into shadow AI, the GenAI tools employees adopt without approval, so organizations can define which tools are approved, monitored, restricted or blocked, and what types of data and actions are prohibited. That turns prompt protection from a standalone security control into part of a broader safe-AI adoption program. For MSPs, it also creates a managed-service opportunity: helping clients move from uncontrolled AI use to governed, policy-aligned AI adoption.

Network-only controls and many legacy endpoint tools may not inspect prompt content directly, especially when AI use happens through browser prompts, pasted text or supported file uploads. That blind spot is exactly where prompt injection succeeds, whether the harmful instruction is typed by a user or hidden in external content the model reads.

Prompt injection is one part of the broader GenAI security problem. Organizations also need to govern which GenAI tools are used, protect sensitive data in AI interactions and detect harmful or policy-violating prompts before they create downstream risk.

Acronis GenAI Protection helps MSPs govern and secure GenAI usage across client environments. Delivered through the Acronis platform rather than a standalone console, it provides visibility into GenAI app usage, helps enforce policy over AI use, inspects prompts and supported content for sensitive data and detects harmful prompts, including prompt injection attempts. Inspection happens at the point where employees actually interact with GenAI tools, so a manipulated prompt does not pass through unnoticed.

For harmful prompt protection specifically, Acronis GenAI Protection can operate in detect-only mode to surface and log risky prompt activity, or in block mode to stop policy-violating prompts before they reach external AI tools. It is part of Acronis's broader approach to securing generative AI, alongside shadow AI discovery and sensitive data protection, so MSPs can extend GenAI protection across client environments without adding another standalone product.

Ready to secure GenAI use across your clients?

• Try Acronis GenAI Protection: https://www.acronis.com/en/products/cloud/trial/
• Get a 1:1 demo: https://www.acronis.com/en/products/cloud/demo/?service=genai-protection
• Join the Acronis Partner Program: https://www.acronis.com/en/partners/registration/

1. Prompt injection is an attack in which crafted input makes an AI model behave in unintended ways, such as ignoring instructions, leaking data or taking unauthorized actions.
2. It is ranked LLM01:2025, the number one risk in the OWASP Top 10 for LLM Applications, 2025 edition, because it exploits how models work rather than a fixable coding flaw.
3. Direct injection comes from the person using the tool, while indirect injection hides in external content the model reads, and multimodal injection conceals instructions in images.
4. Prompt injection is harder to patch than SQL injection or XSS because a model cannot reliably separate trusted instructions from untrusted content.
5. No single control eliminates it, so prevention relies on layered measures including input and output filtering, least-privilege access and human-in-the-loop approval.
6. Prompt injection protection should be part of a broader GenAI governance strategy, including control over which AI apps are approved and restricted.
7. For MSPs, harmful prompt protection complements shadow AI governance and sensitive data protection as part of safer AI adoption.

What is the difference between direct and indirect prompt injection?

Direct prompt injection comes straight from the person interacting with the model, who types an instruction designed to override its behavior. Indirect prompt injection hides in external content, such as a webpage, document or email, that the model reads while doing its job. With indirect injection the attacker never touches the prompt, they plant the instruction in something the model will later process.

Can prompt injection happen without the user doing anything wrong?

Yes. With indirect prompt injection, an employee can ask a model to do something routine, like summarize a webpage or an email, and the model acts on a hidden instruction embedded in that content. The employee did nothing wrong and may never see the malicious instruction, because it can be invisible to a human reader while still being parsed by the model.

How is prompt injection different from jailbreaking?

According to the OWASP Top 10 for LLM Applications, 2025 edition, jailbreaking is a form of prompt injection where the attacker provides input that causes the model to disregard its safety protocols entirely. Prompt injection is the broader category of manipulating a model's behavior through input. Jailbreaking is the specific case aimed at bypassing the model's safety controls.

What is the OWASP Top 10 for LLM Applications?

It is a community-built list, maintained by the OWASP Gen AI Security Project, of the ten most critical security risks in applications that use large language models. In the 2025 edition, prompt injection is ranked first, as LLM01:2025. Security teams use the list as a common reference for what an AI application should be protected against.

How do I protect my organization from prompt injection?

No single control fully prevents it, so use layered defenses: constrain the model's behavior in its system prompt, filter input and output, apply least-privilege access to the functions and data the model can reach, restrict tool and function calling, require human approval for high-risk actions and run regular adversarial testing. At the endpoint, inspecting prompts before they reach the AI tool adds a control where the employee actually works.