Prompt injection is the manipulation of a large language model through crafted input that overrides the developer's instructions and steers the model toward attacker-chosen behavior. Direct injection arrives in the user's own message. Indirect injection arrives through content the model reads, such as a retrieved document or a tool output, without the user knowing.
- Crafted input that overrides developer instructions and redirects behavior
- Direct injection comes from the user; indirect arrives in content the model reads
- Consistently ranked the top risk in the OWASP Top 10 for LLM Applications
- Blast radius scales with the privilege of the agent that was manipulated
Why is prompt injection important?
Prompt injection matters because it is consistently ranked the top risk in the OWASP Top 10 for LLM Applications, and because a successful injection extends an attacker's reach across every tool and datastore the model can access, under whatever identity it holds. The blast radius scales with the agent's privilege level, which means the same technique produces a nuisance in one deployment and a breach in another.
It is also being used at scale. CrowdStrike documented malicious prompts injected into legitimate AI tools at more than 90 organizations during 2025, generating commands that stole credentials and cryptocurrency.
The defensive difficulty is structural. Multi-turn and indirect campaigns delivered through tool outputs and retrieved content can move past static rule sets, because the malicious instruction never appears in a user prompt and may be assembled across several exchanges. That is why both OWASP and the NIST AI Risk Management Framework recommend layered, defense-in-depth controls rather than a single filter.
What is prompt injection?
Prompt injection is an attack in which text supplied to a language model causes it to disregard its original instructions and follow the attacker's instead. The underlying cause is architectural: a model receives instructions and data in the same channel and has no reliable mechanism for telling them apart.
Direct prompt injection is delivered by the person interacting with the system, typically to bypass restrictions on what the model will do. Indirect prompt injection is delivered through content the model consumes on someone else's behalf – a document it summarizes, or a tool response it reads without any user seeing it. The instruction is invisible to the user, and to any control watching only user input.
Indirect injection is the more serious form in agent deployments, because agents read far more third-party content than they receive from users. An agent processing an inbound email or an API response is consuming attacker-writable text on every task.
Prompt injection is distinct from jailbreaking, which aims at a model's safety behavior. Injection aims at the application's instructions and, through them, its permissions.
Types of prompt injection
Injection divides by delivery path and by technique, and the two combine.
By delivery, direct injection arrives in the user turn. Indirect injection arrives through retrieved or supplied content. Tool-description injection is the agent-specific variant, where the metadata describing an available tool carries instructions the agent treats as authoritative.
By technique, instruction override tells the model to disregard what came before. Context manipulation reframes the situation so the original constraints appear not to apply. Multi-turn conditioning shifts the model's behavior gradually across a conversation, with no single message looking malicious. Encoding and obfuscation hide the instruction from pattern matching while leaving it readable to the model. Payload splitting distributes an instruction across sources that only combine at inference.
The practical consequence of the last three is that detection cannot rely on matching known strings.
Prompt injection & Onyx
Onyx AI Guard inspects model calls inline using proprietary small language models trained for the task rather than pattern matching, which is what allows it to catch the paraphrased and obfuscated attempts a rule set would pass, including those built up across several turns. On Onyx's own benchmark of 21,909 production samples, prompt-injection detection is measured at 97.6% accuracy with sub-300ms inline latency.
Inspection is only half of it. Because enforcement is inline, a detected injection meets a decision before the model acts – and Steering can redirect or modify a request so legitimate work continues rather than failing at the boundary. Just-in-Time access limits what a successful injection could reach in the first place, since an agent holding only task-scoped permissions has a smaller blast radius than one carrying standing access. Runtime and prompt injection defense covers both sides.
