Prompt Injection
A security attack targeting LLM-based applications in which an attacker embeds malicious instructions within external content processed by an agent, causing the agent to disregard its original system prompt and execute unauthorized actions. This attack vector is particularly harmful in multi-agent systems, where a compromised agent can propagate malicious behavior across interconnected components.
Core Facts
OWASP lists prompt injection as the top risk in the LLM Top 10 (LLM01).
Prompt injection attacks do not need to exploit software vulnerabilities; they exploit the model's difficulty in distinguishing instructions from data.
Prompt Injection refers to attackers using carefully crafted inputs to induce large language models to ignore original system instructions and execute malicious operations; in multi-agent systems, a compromised agent may propagate malicious instructions to other agents through legitimate internal communication channels.
Timeline (last 90 days)
Unlike traditional SQL injection, prompt injection has no strict syntactic boundaries, making defense harder and often requiring a combination of layered measures such as input filtering, instruction isolation and output validation.
At a time when prompt injection still has no perfect defense, permission isolation is one of the few security controls that can be delivered deterministically.
Denylist Theater as a Prompt injection defense is doomed to fail, because natural language is open-ended and attackers can rewrite, encode, or split instructions indefinitely to bypass it.
Prompt injection cannot be fully filtered, only contained, because it is hidden instructions buried in the content an Agent reads, and the model treats them like user instructions.
The industry currently agrees that there is no general solution to Prompt injection, and its impact can only be reduced through defense in depth at the architectural level.
Simon Willison coined the term Prompt injection in 2022, by analogy with SQL injection.
OWASP lists prompt injection as LLM01, the highest risk for LLM-powered applications in 2026.
In adversarial input scenarios, both typed and generative judges read the content being scored, and the content may carry instructions targeting the judge, so written reasoning cannot reliably expose prompt injection.
Under multi-tenant or shared-memory architectures, the harm of prompt injection is amplified: a single successful injection may poison persistent memory, affecting other sessions or tenants.
Prompt injection attacks do not need to exploit software vulnerabilities; they exploit the model's difficulty in distinguishing instructions from data.
5 more timeline events
All Facts (16)
OWASP lists prompt injection as the top risk in the LLM Top 10 (LLM01).
70%VerifiedPrompt injection attacks do not need to exploit software vulnerabilities; they exploit the model's difficulty in distinguishing instructions from data.
65%VerifiedPrompt Injection refers to attackers using carefully crafted inputs to induce large language models to ignore original system instructions and execute malicious operations; in multi-agent systems, a compromised agent may propagate malicious instructions to other agents through legitimate internal communication channels.
65%Verified提示词注入（Prompt Injection）分为直接注入和间接注入两类，直接注入通过用户输入植入恶意指令，间接注入将恶意指令藏匿于AI可能读取的外部内容中
65%UnverifiedUnlike traditional SQL injection, prompt injection has no strict syntactic boundaries, making defense harder and often requiring a combination of layered measures such as input filtering, instruction isolation and output validation.
50%UnverifiedAt a time when prompt injection still has no perfect defense, permission isolation is one of the few security controls that can be delivered deterministically.
50%UnverifiedDenylist Theater as a Prompt injection defense is doomed to fail, because natural language is open-ended and attackers can rewrite, encode, or split instructions indefinitely to bypass it.
50%UnverifiedPrompt injection cannot be fully filtered, only contained, because it is hidden instructions buried in the content an Agent reads, and the model treats them like user instructions.
50%UnverifiedSimon Willison coined the term Prompt injection in 2022, by analogy with SQL injection.
50%UnverifiedThe industry currently agrees that there is no general solution to Prompt injection, and its impact can only be reduced through defense in depth at the architectural level.
50%UnverifiedOWASP lists prompt injection as LLM01, the highest risk for LLM-powered applications in 2026.
50%UnverifiedIn adversarial input scenarios, both typed and generative judges read the content being scored, and the content may carry instructions targeting the judge, so written reasoning cannot reliably expose prompt injection.
50%UnverifiedUnder multi-tenant or shared-memory architectures, the harm of prompt injection is amplified: a single successful injection may poison persistent memory, affecting other sessions or tenants.
50%UnverifiedRAGGuardrails类实现输入和输出护栏：输入检查拦截Prompt注入（检测'ignore previous instructions'等触发词）和PII泄露（正则匹配SSN、邮箱、信用卡号、电话号码）；输出检查包含幻觉检测（提取答案中的数字，检查是否在上下文中，长度超过2位的数字若不在上下文则标记为未验证声明）和PII检测，并在PII出现时用[REDACTED]替换。
50%UnverifiedAgents may execute destructive operations far beyond what was intended due to hallucination or prompt injection attacks.
50%Unverified即使prompt注入成功改变了模型行为，若容器层面锁死了网络、文件系统和API访问，模型也无法执行危险操作
50%