Prompt Injection
An attack where untrusted text, often returned by a tool, carries an instruction the model obeys, because the model cannot reliably tell instructions from data. The top security risk for agents, and unsolved by prompting alone.
What is Prompt Injection?
An attack where untrusted text, often returned by a tool, carries an instruction the model obeys, because the model cannot reliably tell instructions from data. The top security risk for agents, and unsolved by prompting alone.
Prompt Injection is a advanced concept that sits in the LLM and GenAI Ops area of system design. Engineers reach for it whenever they need to reason about real-world trade-offs in that space, not just for textbook correctness, but because real production systems at companies like Netflix, Amazon, and Google make these decisions every day.
If you want to go deeper than this definition, with diagrams, code, and a quiz to lock it in, work through the "LLM Guardrails and Safety" lesson linked below. It walks through the why, the mechanism, the trade-offs, and how the giants actually use it in production.
Learn Prompt Injection in depth
Full interactive lesson with diagrams, code examples, real-world references, and a quiz.
Open the LLM Guardrails and Safety lessonRelated lessons
Lessons that touch on Prompt Injection as part of a larger topic.
Prompt Injection and the Lethal Trifecta: Why LLM Agents Leak Data
Prompt injection is the top LLM security risk. Learn why it has no clean fix, how indirect injection works, and what the lethal trifecta is.
ml-advanced · security
Defending Against Prompt Injection: The Layered Playbook
Prompt injection has no single fix. Layer the defenses: separate instructions from data, use dual-LLM and CaMeL, allow-list egress, gate risky actions.
ml-advanced · security
The Lethal Trifecta: Why Prompt Injection Plus Tools Plus Data Is Unsolved
A filter that stops 95 percent of prompt injections still loses to twenty retries. The lethal trifecta is unsolved because detection is the wrong tool. Break it leg by leg instead.
ml-advanced · security
OWASP Agentic Threat Model and Red-Teaming Your Agent
Organize agent threats with the OWASP LLM Top 10 and Agentic guides, then red-team your own agent and run it as an attack-success-rate eval in CI.
ml-advanced · security
Data Exfiltration and Egress Control in LLM Systems
A steered model needs no click to leak data, it writes a line of markdown. The exfiltration channels, and the egress controls that close every exit.
ml-advanced · security
See also
Related glossary terms you might want to look up next.
Guardrails
The checks around a model that screen its input for abuse and its output for grounding and safety, plus limits on what its tools can do. Containment, not just filtering, is what actually holds.
AI Agent
A language model placed in a loop: it decides an action, calls a tool, reads the result, and repeats until done. The hard part is that per-step errors compound over many steps.
Lethal Trifecta
The dangerous combination of access to private data, exposure to untrusted content, and a way to exfiltrate. An agent with all three can be turned against its own user by a prompt injection.
RAG (Retrieval-Augmented Generation)
A pattern that retrieves relevant text from an external index and puts it in the model's prompt so the answer is grounded in current, verifiable facts rather than the model's memory.
Embedding
A list of numbers that represents the meaning of a piece of text, so that similar meanings sit close together in vector space. The same model must embed both the corpus and the query.
ANN (Approximate Nearest Neighbor)
Search that finds vectors close to a query without scanning every item, trading a small chance of missing a true neighbor for a large gain in speed. HNSW and IVF are the common indexes.