Prompt injection happens when text an AI reads, a web page, email, or document, carries hidden instructions the model obeys. No reliable fix exists, OWASP ranks it first and the UK's NCSC calls it a residual risk. Prevention means design: remove one leg of the lethal trifecta, limit permissions, gate irreversible actions with approval, and control outbound traffic.
SQL injection was largely tamed by one idea: keep the query and the user's data in separate channels, so the database never mistakes data for a command. Prompt injection has no equivalent. A language model reads instructions and content as the same stream of text, which means anything it reads can try to give it orders.
That's harmless in a chatbot that only talks. It becomes serious the moment the model can read your email, browse the web, or call tools. This guide explains how the attack works, why it can't simply be patched, and the design choices that actually limit the damage when an attack gets through.
What Is Prompt Injection, and How Is It Different From a Jailbreak?
A jailbreak is a user trying to talk a model out of its own safety rules. Prompt injection is different: the attacker isn't the user at all. They plant instructions in content the model will read later, and the model follows them while working for someone else.
Direct injection means the attacker types the malicious text themselves. Indirect injection is the one that matters for agents: the instructions sit inside a web page, email, document, or tool result that your agent fetches on its own, and you never see them.
Why Can't Prompt Injection Just Be Patched?
Because the weakness isn't a bug, it's how models work. The UK's National Cyber Security Centre explains that an AI model makes no real distinction between content it reads and commands it follows. In December 2025 the NCSC advised treating prompt injection as a residual risk, and limiting its impact with deterministic controls on what the system is able to do.
OWASP has ranked prompt injection first on its Top 10 for LLM Applications, as LLM01, and published a separate Top 10 for Agentic Applications on December 9, 2025, listing agent goal hijack, tool misuse, and memory poisoning among its ten agent risks. One recent write-up reports that OWASP's 2026 guidance states plainly that no reliable prevention mechanism exists today.
Design has to do the work that detection can't. Pressure is rising too: one security report, citing HackerOne, found prompt injection reports growing by 540%.
What Is the Lethal Trifecta?
Security researcher Simon Willison coined the term in June 2025 for three capabilities that become dangerous in combination: access to private data, exposure to untrusted content, and the ability to communicate externally. An agent with all three can be tricked into reading your private data and sending it to an attacker.
The useful part is the rule that follows: remove at least one leg, and an injection becomes an annoyance instead of a breach. Meta's related "Rule of Two" framing makes the same point, an agent shouldn't hold all three without a human approving each action.
A plain example is an email assistant. It reads your private inbox, it ingests emails written by strangers, and it can send mail. That's all three legs in one product. EchoLeak, a 2025 attack on Microsoft 365 Copilot, showed the shape of the problem by leaking data through a rendered link.
Where Do Hidden Instructions Actually Come From?
Anywhere an outsider can write text your agent will read: web pages, emails, shared documents, calendar invites, issue trackers, support tickets, and the output of other tools. They can be invisible to you, white text on a white background, or buried in a long document.
Treat all retrieved content and tool results as attacker-supplied. That single habit changes how you design everything else.
Which Defenses Actually Work, Ranked Honestly?
Architecture comes first, because it limits damage even when the model is fooled. Give each agent the narrowest credentials it needs, with read-only defaults. Gate irreversible or external actions with human approval. Control outbound traffic with allowlisted fetches, and don't render untrusted links or images. Validate anything written to long-term memory. Run tools in a sandbox and log every action.
Filters and detectors come second. They can catch crude attacks and reduce noise, but they are not a boundary. Model-level training helps too, yet no vendor can promise it's airtight.
A stronger pattern is separation: one component reads untrusted content and has no tools, another holds the tools and never sees raw untrusted text. It's more work to build, and it targets the trifecta directly instead of hoping to spot every attack.
Do Filters and Prompt-Injection Detectors Protect You?
Not by themselves. In one academic evaluation of multi-agent systems, Azure's content filters failed on every task tested, and Meta's PromptGuard flagged many ordinary injections but missed control-flow hijacks entirely.
Research titled "The Attacker Moves Second" makes a broader point: when attackers adapt to a specific defense, published defenses can be bypassed. A detector that scores well on yesterday's attacks is not evidence it will survive a motivated attacker tomorrow.
Use detectors as an extra layer and an alarm, not as the reason you feel safe.
Why Does Least Privilege Sometimes Fail?
The same study found a limit worth knowing: least privilege couldn't block attacks when the attacker only needed a tool the user's legitimate task also required. If your agent is allowed to send email because that's its job, an injected instruction can ask it to send email too.
The lesson is that permissions alone aren't enough. Pair them with approval on the dangerous action itself, outbound allowlists, and logging, so that "appropriate tool, inappropriate use" gets caught at the moment it happens.
How Do You Add Human Approval Without Approval Fatigue?
Approvals fail when they become a reflex. If a person clicks Allow forty times a day on vague prompts, the gate is decorative.
Show the exact action, the recipient, the amount, and the data leaving the system, so the human is judging a specific thing instead of a general permission. Require approval only for irreversible or external actions, and let low-risk reads proceed. Default to deny when the agent wants something outside its normal pattern.
What Is a Practical Security Checklist for Your Agent This Week?
Run the trifecta test: write down the agent's private data, its untrusted inputs, and its ways out, then remove at least one.
Scope credentials: per-tool, read-only by default, nothing broader than the task needs.
Gate irreversible actions: payments, deletions, outbound messages, and permission changes need specific human approval.
Control egress: allowlist the domains the agent may contact, and don't render untrusted links or images.
Protect memory: validate what gets saved to long-term memory, since poisoned notes can steer future runs.
Log and rehearse: record every tool call, keep a kill switch, and test the agent against injected instructions yourself.
What Should You Ask Vendors Who Claim to Stop Prompt Injection?
The NCSC specifically cautions against vendors who claim they can stop these attacks outright, because at the time of writing nobody can. Treat "100% protected" as a warning sign, not a feature.
Ask better questions instead: which leg of the trifecta does the product remove, what can the agent send out and to where, which actions need approval, what gets logged, and what red-team results can they show. Specific answers matter more than a confident slogan.
Quick Verdict
Prompt injection won't be patched away this year, and the people who set the standards say so plainly. The teams that stay safe aren't the ones with the cleverest filter, they're the ones who designed agents so a tricked model can't reach anything that matters. Remove a leg of the trifecta, narrow the permissions, gate the irreversible, and watch the exits.
Frequently Asked Questions
What is prompt injection?
It's an attack where text an AI reads, such as a web page, email, or document, contains hidden instructions that the model follows, because models don't reliably separate instructions from content.
What's the difference between prompt injection and a jailbreak?
A jailbreak is a user trying to bypass a model's safety rules. Prompt injection is an outside attacker planting instructions in content the model reads while working for someone else.
Can prompt injection be fully prevented?
No. The UK NCSC advises treating it as a residual risk, and OWASP ranks it first among LLM risks. The goal is limiting damage through design, not eliminating the attack.
What is the lethal trifecta?
Simon Willison's term for an agent that has access to private data, exposure to untrusted content, and the ability to communicate externally. Removing at least one of the three stops most data-theft scenarios.
Do prompt injection detectors work?
They catch some attacks but aren't a boundary. One study found Azure's content filters failed on all tested tasks, and adaptive attackers can bypass published defenses, so use detectors as an extra layer only.
