AI security
Prompt injection: what it is and how to reduce the risk
A plain guide for IT, security and operations leads. Every fact on prompt injection is taken from OWASP's and Anthropic's own pages, as read on 10 November 2026.
Prompt injection is an attack in which text given to an AI model changes what the model does, in a way its owner did not intend. OWASP lists it as LLM01 in its 2025 Top 10 for LLM applications. It says the text can be typed by a user or picked up by the model from a web page or file. OWASP also says it is unclear whether any method can prevent it fully, so the practical aim is to limit the damage. That means giving the AI the least access it needs, keeping untrusted content apart from instructions, and having a person approve high-risk actions. Sources read on 10 November 2026.
definition
What is prompt injection?
Prompt injection is when input to a language model alters the model's behavior or output in a way nobody intended. OWASP defines it this way: a prompt injection vulnerability occurs when user prompts alter the model's behavior or output in unintended ways (OWASP LLM01:2025, read 10 November 2026).
OWASP adds that the input does not have to be readable by a person. If the model parses the content, it can affect the model. The same page separates prompt injection from jailbreaking. It describes jailbreaking as a form of prompt injection in which the attacker's input makes the model disregard its safety protocols entirely.
two kinds
What is the difference between direct and indirect injection?
OWASP describes two kinds. In a direct injection, a user's own prompt changes the model's behavior. In an indirect injection, the model accepts input from an outside source such as a website or a file, and that content carries instructions that change what the model does. OWASP says either kind can be intentional or unintentional.
Anthropic draws the same line by asking who the adversary is. In jailbreaks and direct prompt injection the user of the application is the adversary. In indirect prompt injection the user is trusted, but the model processes third-party content such as webpages, emails, documents or tool results that contain adversarial instructions (Anthropic, Mitigate jailbreaks and prompt injections, read 10 November 2026).
Our reading: an assistant that only answers typed questions faces mostly the first kind. An agent that reads email, files or web pages on someone's behalf also faces the second.
impact
What can go wrong?
OWASP says the impact can vary greatly and depends on the business context the model works in and on the agency with which the model is architected, meaning how much it is allowed to do. It lists outcomes that include:
- disclosure of sensitive information
- revealing sensitive information about AI system infrastructure or system prompts
- content manipulation leading to incorrect or biased outputs
- unauthorized access to functions available to the model
- executing arbitrary commands in connected systems
- manipulating critical decision-making processes
One of OWASP's own examples is a user asking a model to summarize a web page that contains hidden instructions, which lead the model to insert an image link that sends the private conversation to another address.
prevention
Can prompt injection be fully prevented?
OWASP does not say so. It writes that, given the stochastic influence at the heart of how models work, it is unclear whether there are fool-proof methods of prevention. It also says research shows that retrieval augmented generation (RAG) and fine-tuning do not fully mitigate prompt injection vulnerabilities.
What OWASP offers instead is a list of measures that can mitigate the impact. Anthropic takes the same stance. Its page says Claude is inherently resilient to such attacks, and that the extra steps it lists strengthen your guardrails. Neither source promises that a successful attack cannot happen, so plan for limiting harm, not for full prevention.
controls
What controls reduce the risk?
OWASP lists seven mitigation strategies. Anthropic's page lists measures that line up with several of them. The table sets them side by side, in our wording.
| Control | What OWASP says | What Anthropic says |
|---|---|---|
| Constrain the model | Give the model a specific role, capabilities and limits in the system prompt, and tell it to ignore attempts to change its core instructions. | Write system prompts that set boundaries and tell the model how to refuse. |
| Check outputs and formats | Define expected output formats and use deterministic code to check them. Apply input and output filtering. | Filter user input for known injection patterns. Screen tool output before the model acts on it. |
| Limit privileges | Restrict the model's access to the minimum needed. Handle extra functions in code, not through the model. | Apply least privilege: no access to secrets the model does not need, sandboxed tools, narrowly scoped permissions. |
| Keep a person in the loop | Require human approval for high-risk actions. | Not listed on the page as a separate step. The page refers to confirmation steps in its testing advice. |
| Separate untrusted content | Separate and clearly denote untrusted content to limit its influence. | Put third-party content only in tool results, say where it came from, and state in the system prompt that it is untrusted data. |
| Test and watch | Run regular adversarial testing and breach simulations, treating the model as an untrusted user. | Red-team the agent before launch and keep analyzing outputs for signs of successful injection. |
checklist
What should you ask before an AI reads outside content?
This is our own checklist, built from the controls above, not a standard. Before an assistant or agent is allowed to read email, files, web pages or tool results, settle these in writing:
- What outside content will it read, and who can change that content?
- What can it do after reading it: only answer, or also send, write or delete?
- Which of those actions need a named person to approve them first?
- What does it hold access to that it does not need for this task?
- How will you test it with deliberately hostile content, and who looks at the results?
The answers decide how much damage one successful injection could do. A read-only summarizer and an agent that can write to a system of record carry very different risk from the same injected instruction.
kriv role
How does Kriv AI help?
Kriv AI designs and builds governed AI agents connected to a client's own systems, and trains the people who work alongside them. For prompt injection, our work is informed by the OWASP and Anthropic guidance on this page: scoping what an agent can reach, keeping approvals with named people, and testing with hostile content before launch. This page is general information, not a security assessment, and it does not promise that any system is protected from attack.
For the wider picture see our pages on AI guardrails, AI agent security risk in the enterprise, and AI security.
limits
What this page could not confirm
This page rests on the two pages listed below, as read on 10 November 2026. Neither page shows a publication date. We did not test any product or run an injection test. We did not read OWASP's cheat sheets or Microsoft's documentation, so nothing here describes a Microsoft product. Check the current pages before you plan, because guidance in this area changes often.
Related resources
Continue exploring
Straight answers
Frequently asked questions about Prompt injection: what it is and how to reduce the risk
What is prompt injection in simple terms?
It is text that changes what an AI model does in a way its owner did not intend. OWASP says it occurs when user prompts alter the model's behavior or output in unintended ways, and that the content can affect the model even if a person cannot see it (read 10 November 2026).
Is prompt injection the same as jailbreaking?
They are related. OWASP says jailbreaking is a form of prompt injection in which the attacker's input makes the model disregard its safety protocols entirely, and notes that the two terms are often used interchangeably (read 10 November 2026).
What is indirect prompt injection?
It is when the model reads outside content, such as a web page, email or file, that carries hidden instructions. Anthropic describes the user as trusted in this case and the third-party content as the source of the adversarial instructions (read 10 November 2026).
Does RAG or fine-tuning stop prompt injection?
No. OWASP says research shows that retrieval augmented generation and fine-tuning do not fully mitigate prompt injection vulnerabilities (read 10 November 2026).
Can prompt injection be prevented completely?
OWASP says it is unclear whether there are fool-proof methods of prevention, and lists measures that can mitigate the impact. Plan to limit what a successful attack can do (read 10 November 2026).
Talk to the team that would do the work
Bring your requirements to a working session with the person who'll actually deliver.
Book a Discovery Call