Prompt Injection
Prompt injection is an AI security attack technique that exploits the architectural limitation of large language models in distinguishing between data and instructions. By crafting specific inputs, attackers can bypass a model's safety constraints and redirect its behavior, drawing an analogy to traditional SQL injection attacks in conventional software systems.
Core Facts
Prompt注入（Prompt Injection）是针对大语言模型应用的安全威胁，攻击者通过在输入中嵌入恶意指令试图覆盖系统原有行为约束
Prompt injection attacks are a serious threat facing local AI Agents, as maliciously crafted content in files processed by the Agent may induce it to execute dangerous operations.
Prompt Injection is a security attack method targeting AI applications, analogous to SQL injection in traditional web development.
Timeline (last 90 days)
Recommendations for defending against Prompt Injection and Tool Poisoning include: personally read the tool descriptions of new Servers, remove any suspicious instructions found, re-check after updates, least privilege, secondary confirmation for sensitive operations, and whitelist restrictions on data sources.
In AI agents, instructions and data are merged into the same plain-text stream, and the model has no parser to determine whether the data is trustworthy, which is the root of prompt injection.
The difficulty of defending against prompt injection lies in the inherently mixed input of language models (system prompts, user requests, and external data all enter the same context window), and there is currently no general technical means to fully isolate them; input filtering, least privilege, and secondary confirmation of sensitive operations can only reduce risk, not eliminate it.
Prompt Injection is an attack method against large language models, first systematically described in 2022 by security researcher Simon Willison; its principle is similar to SQL injection, and it is one of the biggest unsolved problems in the AI Agent field.
The key similarity between prompt injection and traditional injection attacks is that the system cannot reliably distinguish trusted instructions from untrusted data.
Mitigations such as adding a safety reminder to the model are inherently fragile and cannot fundamentally fix prompt injection.
Common variants of prompt injection include direct injection, indirect injection and jailbreak.
The first edition of the OWASP Top 10 for LLM Applications in 2023 listed Prompt Injection as LLM01, and the 2025 edition still places it first and subdivides it into direct injection and indirect injection.
If malicious instructions are mixed into the knowledge base of a RAG (retrieval-augmented generation) system, the retrieval stage becomes an entry point for prompt injection.
Judging whether a prompt injection attack succeeds must be done at two layers: whether the AI accepted external instructions, and whether the tool side actually executed the operation.
40 more timeline events
All Facts (20)
Prompt注入（Prompt Injection）是针对大语言模型应用的安全威胁，攻击者通过在输入中嵌入恶意指令试图覆盖系统原有行为约束
90%VerifiedPrompt injection attacks are a serious threat facing local AI Agents, as maliciously crafted content in files processed by the Agent may induce it to execute dangerous operations.
90%VerifiedPrompt Injection is a security attack method targeting AI applications, analogous to SQL injection in traditional web development.
85%VerifiedCompared to traditional scripts, AI Agents are unpredictable and carry inherent risks such as hallucinations, context misinterpretation, and susceptibility to prompt injection attacks.
80%VerifiedPrompt injection is essentially an architectural flaw in which large language models cannot distinguish data from instructions, analogous to traditional SQL injection in which the database engine confuses data with SQL instructions.
80%VerifiedIndirect prompt injection attacks plant hidden instructions within normal business data to induce Agents into executing unauthorized operations, representing a security risk at the semantic level rather than the code level.
80%VerifiedPrompt injection attacks induce AI agents to execute malicious operations by embedding text disguised as system instructions in code comments, documentation, web content, or even file names.
80%VerifiedIn a Prompt Injection attack, an attacker can craft a special input to induce the Agent to perform unintended operations.
80%VerifiedOWASP已将Prompt注入列为LLM应用十大安全风险之首
80%VerifiedAI systems have introduced entirely new dimensions of security risk, including erroneous decisions caused by model hallucinations, prompt injection attacks, training data poisoning, and AI agent privilege abuse.
80%VerifiedPrompt injection has become one of the most closely watched attack surfaces in the field of agent security
75%Verified提示注入是一种针对大语言模型的攻击手法，攻击者通过在模型输入数据中嵌入恶意指令劫持模型的正常行为
75%VerifiedOne of the security risks of MCP is prompt injection attacks, where malicious data sources may embed instructions in returned content to induce the model to perform unauthorized operations.
70%VerifiedPrivilege level and data access scope determine the severity of a vulnerability.
70%VerifiedIndirect prompt injection is an attack vector in which an attacker embeds malicious instructions in web pages, documents, or emails that an agent may read, inducing the agent to perform operations beyond the scope of the original task.
70%VerifiedIndirect prompt injection refers to attack instructions hidden in external web pages, documents, or API responses accessed by an agent, where the malicious instructions are activated when the agent retrieves and injects them into the context.
70%VerifiedLarge language models are architecturally incapable of strictly distinguishing between system instructions and user data, which is a fundamental flaw at the architectural level.
70%VerifiedPrompt injection attacks can use carefully crafted user inputs to induce the model to ignore the constraints of the system prompt.
70%VerifiedThe prompt injection security threat category was first systematically proposed by security researcher Simon Willison in 2022.
70%VerifiedAI代理操控计算机面临的安全风险包括提示注入攻击、权限升级和不可逆操作等问题
70%