Prompt injection: your questions answered

It is an attack where an input is crafted to make an AI model behave in an unintended way[3]. The results can include leaking confidential information or triggering actions in systems that accept unchecked input[3].

Not completely, according to the NCSC. SQL injection can be properly mitigated, but language models do not enforce a boundary between instructions and data, so a complete mitigation may never be possible[1]. The practical aim is to make attacks less likely and less damaging.

It happens when a model reads external content, such as a web page or a file, that contains instructions it then follows[4]. The user typing the request is not the attacker.

OWASP describes jailbreaking as a related form in which the attacker aims to make the model disregard its safety protocols entirely[4]. Prompt injection is the wider term for input that changes a model's behaviour in unintended ways.

Yes. Researchers at Aim Security found EchoLeak, CVE-2025-32711, which let a crafted email lead Copilot to leak data without any user action[7]. Microsoft said it was fully addressed and no customer action was necessary[7].

Simon Willison uses the term for an AI agent that has access to private data, is exposed to untrusted content and can communicate externally[6]. An agent with all three can be tricked into stealing data, and his advice is to avoid the combination[6].

OpenAI says prompt injection is unlikely to ever be fully solved and that agent mode in ChatGPT Atlas expands the security threat surface[9]. Its advice includes limiting logged-in access and reviewing confirmation requests[9].

Not reliably. The NCSC warns against deny-listing phrases because attackers can rephrase them endlessly[1]. It also advises being sceptical of products that claim to stop prompt injection[1].

List the AI tools in use and what each can read, see and do, then limit the riskiest combinations. For anything that handles outside content, the NCSC advises lowering the access it holds[1].

Yes. The government's code of practice for AI cyber security sets out a minimum set of principles for organisations building or running AI systems[5]. The NCSC also publishes guidance on AI and cyber security[3].