Mehmet EmrahKonyaTR
← Back to glossary

Prompt injection

İstem enjeksiyonu

D5

Prompt injection is an attack in which untrusted content supplies instructions that conflict with or redirect an LLM-integrated system’s intended instructions or data handling.

Review status: 2026-11-26

Technical explanation

It can be direct through a user’s input or indirect through content that a system retrieves, reads, or processes, and can affect connected tools or data flows.

Conceptual boundaries

Prompt injection is not ordinary prompt engineering, a hallucination, or a problem solved by a stronger system prompt alone.

Provider-neutral example

A document retrieved for summarization can contain hidden instructions that attempt to make an assistant disclose its system prompt or invoke an unrelated tool.

Limitations

Mitigations can reduce impact, but current guidance does not establish a fool-proof prevention method for every LLM-integrated system.

Related concepts

Atomic claims and evidence

  1. 1.1NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — D5 security slice
    Source
    NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — D5 security slice
    Source role
    Authoritative source
    Exact locator
    Sections 3.2-3.4, printed pp. 40-53
    Supported claim
    NIST describes direct and indirect prompt injection, including indirect attacks that can substitute malicious instructions for a model’s system prompt through processed external content.
    Last verification
    Review due
    Scope limitation
    This taxonomy describes attack forms; it does not imply that every external document contains an attack.
    1.2MITRE ATLAS, Prompt Infiltration via Public-Facing Application
    Source
    MITRE ATLAS, Prompt Infiltration via Public-Facing Application
    Source role
    Authoritative source
    Exact locator
    Definition
    Supported claim
    NIST describes direct and indirect prompt injection, including indirect attacks that can substitute malicious instructions for a model’s system prompt through processed external content.
    Last verification
    Review due
    Scope limitation
    This taxonomy describes attack forms; it does not imply that every external document contains an attack.
  2. 2.1OWASP LLM Prompt Injection Prevention Cheat Sheet
    Source
    OWASP LLM Prompt Injection Prevention Cheat Sheet
    Source role
    Supplementary source
    Exact locator
    Primary Defenses; Additional Defenses; Best Practices Checklist
    Supported claim
    OWASP identifies input validation, structured separation of instructions and data, output validation, least privilege, monitoring, and human controls as defenses, while noting that defenses mitigate rather than guarantee prevention.
    Last verification
    Review due
    Scope limitation
    The listed defenses are context-dependent controls, not proof that a stronger system prompt alone solves prompt injection.
    2.2MITRE CWE-1427, Improper Neutralization of Input Used for LLM Prompting
    Source
    MITRE CWE-1427, Improper Neutralization of Input Used for LLM Prompting
    Source role
    Authoritative source
    Exact locator
    Potential Mitigations; Modes Of Introduction
    Supported claim
    OWASP identifies input validation, structured separation of instructions and data, output validation, least privilege, monitoring, and human controls as defenses, while noting that defenses mitigate rather than guarantee prevention.
    Last verification
    Review due
    Scope limitation
    The listed defenses are context-dependent controls, not proof that a stronger system prompt alone solves prompt injection.
    2.3NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — D5 security slice
    Source
    NIST AI 100-2e2025, Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — D5 security slice
    Source role
    Authoritative source
    Exact locator
    Sections 3.3.3 and 3.4.4, printed pp. 47-49 and 53
    Supported claim
    OWASP identifies input validation, structured separation of instructions and data, output validation, least privilege, monitoring, and human controls as defenses, while noting that defenses mitigate rather than guarantee prevention.
    Last verification
    Review due
    Scope limitation
    The listed defenses are context-dependent controls, not proof that a stronger system prompt alone solves prompt injection.