Prompt Injection

Prompt injection is the LLM equivalent of slipping a forged note into someone's reading pile. An attacker plants instructions in the input a model processes, and the model follows them instead of its own rules. Direct injection is typed straight into the chat ("ignore your previous instructions and..."); indirect injection hides the payload in content the model reads on its own — a support ticket, an email, an attachment, a knowledge-base article, a web page it retrieves. OWASP ranks it LLM01, the number-one risk in its 2025 Top 10 for LLM applications.

Support is an unusually soft target, because the job is reading untrusted text from strangers and, increasingly, acting on it. A modern AI agent doesn't just draft a reply — it looks up accounts, checks entitlements, and sometimes issues refunds or changes settings through connected tools. That is the exact shape indirect injection exploits: a customer pastes an "error log" into a ticket with a buried line telling the agent to attach another customer's billing history, or to waive the refund cap. The agent was built to be helpful and to trust what it reads, and the attack weaponises both.

There is no patch for this. OWASP is blunt that because the behaviour falls out of how models process language, no fool-proof prevention is known — defence is layered: filtering inputs and outputs, limiting the model's privileges, segregating untrusted content, and requiring human approval before high-risk actions. Controlled benchmarks show why that matters: the attacks land far more often than teams assume.

What it hides: a demo that shrugs off the obvious "ignore your instructions" makes the problem look solved. It isn't — the real risk scales with what you wire the model to. A bot that can only talk has a small blast radius; one connected to your CRM, your refund API, or your internal knowledge base has a large one. The question is never "can it be injected" — assume yes — but "what is the worst thing it can do the day it is."