The basics
Prompt injection explained without the jargon
Prompt injection is an attack that makes an AI model act in a way its owner did not intend. It works because the model cannot reliably tell instructions from the data it is given.
Last reviewed against NCSC (UK), OWASP Gen AI Security Project and UK Government (DSIT). Sources
The definition
What the attack does
For the NCSC, the attacker builds an input meant to push the model off its intended behaviour [3]. Outcomes range from offensive content to exposed confidential information and unplanned actions in systems that take input without checking it [3]. OWASP adds that the malicious text does not have to be visible to people, only readable by the model [4].
Why it works
No wall between instructions and data
Not SQL injection
Why the comparison misleads
SQL injection has a fix
Parameterised queries separate commands from data, and SQL injection can be properly mitigated with them [1].
Prompt injection has no equivalent
The risk of misreading it
The NCSC warned that if the difference goes unaddressed, websites could suffer data breaches larger than those caused by SQL injection in the 2010s [2].
Related terms
Where jailbreaks fit
OWASP treats jailbreaking as a related form of prompt injection, in which the attacker tries to make the model ignore its safety protocols altogether [4]. For an organisation the practical difference is aim: a jailbreak targets the model's rules, while injection into a business tool usually targets the data and actions that tool can reach.
Remember this
If a tool can be talked into something, assume someone will try. The question for your organisation is what it could do if they succeeded [1].
What next
Where to go from here
Read how indirect injection reaches tools through content, and then test your own tools against the exposure checklist.
Keep reading
Read next
Indirect injection
How instructions hidden in emails, web pages and documents can steer an AI tool, with OWASP's example scenarios and what to limit.
Read the guide
Lethal trifecta
Simon Willison's lethal trifecta explained: private data, untrusted content and external communication, and how to break the combination.
Read the guide
EchoLeak
What EchoLeak (CVE-2025-32711) was, how a crafted email could leak data from Copilot, what Microsoft said and what it teaches UK organisations.
Read the guideHow CyPro can help
Need a hand with any of this?
Patching is one job. Keeping a vulnerable system safe until it is patched, and proving it, is several more. CyPro's consultants, testers and SOC analysts can take any of them off your plate.
Vulnerability scanning
Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.
See the scanning service
Hardening and segmentation
Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.
More on cypro.co.uk
24/7 security monitoring
Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.
More on cypro.co.uk
Penetration testing
A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.
More on cypro.co.uk
Incident response
If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.
More on cypro.co.uk
Fractional CISO for the board
A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.
More on cypro.co.uk
Know your exposure
Not sure you are protected?
Prompt injection cannot be patched away, so the useful question is how far a manipulated tool could reach. Testing your AI-connected systems the way an attacker would shows where the limits on data and actions need tightening.