Prompt injection is an attack in which untrusted input causes an LLM to follow an attacker's instructions instead of the developer's. The root cause is architectural: an LLM receives instructions and data in the same token stream. There is no privileged channel that reliably separates the two.
Any text the model reads, whether typed by a user or pulled from a document, can potentially steer its behavior.
The Open Worldwide Application Security Project (OWASP) ranks prompt injection first because it is both high impact and not fully solved. An attack can leak context, trigger unauthorized tools, bypass content policy, or manipulate output shown to users.
Unlike SQL injection, there is no equivalent of parameterized queries that fully fixes it. So mitigation relies on defense in depth. Constrain what the model can access and do, filter inputs and outputs, require human confirmation for consequential actions, and monitor for anomalies.
Every design decision about an LLM feature should assume some injected instruction will eventually get through.
This answer doesn't lend itself to a diagram - it reads best . No credits were charged.
Why there's no diagram: “”
The interactive diagram is below the answer - jump to diagram ↓ · Below it, the related concept . Jump to it ↓
The diagram below the answer is the concept . Jump to it ↓