# Prompt Injection

AI Glossary · Governance, Risk & Ethics
Canonical URL: https://aisat.uk/glossary/prompt-injection
Author: Lucy Gilmore, Assistant General Counsel, Product, Privacy & AI at Sprinklr | Practical Privacy, Product & AI Governance & Defensible Risk Decisions (https://www.linkedin.com/in/lucy-gilmore/)
Breadcrumb: [Glossary](https://aisat.uk/glossary) > [Governance](https://aisat.uk/glossary?category=governance) > Prompt Injection

## TL;DR

> **Prompt injection** is a security vulnerability in which malicious or untrusted text tricks a language model into ignoring its developer instructions and executing unintended commands. Because LLMs process system rules and user data inside the same token stream, they cannot natively separate code from data.

## How Prompt Injection works in practice

In classic software engineering, SQL injection was solved via parameterised queries that strictly separate the database command parser from user-supplied variables. Language models have no such hardware or parser boundary: system instructions, tool schemas, retrieved documents, and user inputs are all concatenated into a single sequence of tokens.

Security teams categorise attacks into two classes. Direct prompt injection happens when a user at the keyboard explicitly crafts adversarial input (often called a jailbreak) to bypass safety filters, reveal system prompts, or coerce a customer-service bot into approving a refund. Indirect prompt injection is far more dangerous for enterprise systems: an attacker plants hidden instructions inside external content that an AI agent or RAG pipeline later ingests, such as an email body, a public webpage, a CV uploaded in white-on-white text, or a poisoned GitHub issue.

For example, if an internal executive assistant agent has MCP access to read incoming emails and search Google Drive, an attacker can send an email containing hidden instructions that tell the agent to search Drive for board acquisition memos and exfiltrate the summary via a markdown image link or an outbound API call.

## Why it matters and trade-offs

OWASP consistently ranks prompt injection as the number-one vulnerability for LLM applications, and the rise of tool-using AI agents has turned it from a reputational embarrassment into a remote code execution and data exfiltration vector. Whenever an agent possesses what security researchers call the 'lethal trifecta' (access to private data, exposure to untrusted external content, and the ability to communicate externally or mutate state), indirect prompt injection can compromise the system.

Because prompt-level classifiers and input guardrails can always be bypassed by sufficiently creative encodings, true mitigation requires architectural privilege separation: sandboxing code execution, stripping external markdown links, restricting tool permissions per task, and enforcing deterministic human-in-the-loop approval before any write or outbound action executes.

## Related AI concepts

- [Guardrails](https://aisat.uk/glossary/guardrails): Guardrails are programmable validation layers placed on the input and output paths of an AI application to detect prompt injections, redact personally identifiable information, verify citations and block policy-violating completions in real time.
- [AI Agent](https://aisat.uk/glossary/ai-agent): An AI Agent is a software system powered by a large language model that perceives environment context, maintains state, formulates multi-step plans and executes actions across external tools, APIs and databases to complete a delegated goal.
- [Model Context Protocol (MCP)](https://aisat.uk/glossary/model-context-protocol): Model Context Protocol (MCP) is an open JSON-RPC standard introduced by Anthropic in November 2024 and donated to the Linux Foundation's Agentic AI Foundation in December 2025 that standardises how AI models and agents connect to external data and tools.
- [Context Engineering](https://aisat.uk/glossary/context-engineering): Context Engineering is the engineering discipline of dynamically selecting, structuring, compressing and ordering the system instructions, retrieved knowledge, tool definitions, memory and examples placed inside a language model's context window at inference time.