What Is Prompt Injection? A Technical Guide

Prompt injection is the practice of getting an AI system to treat attacker-supplied text as an instruction rather than as data. It's the single most common way real AI agents get compromised in production, and it's structurally different from the injection attacks security teams already know how to defend against.

Why it's not just "SQL injection for AI"

SQL injection works because a database can't tell the difference between a query and data that looks like a query, unless the application enforces that boundary explicitly (parameterized queries, escaping). Prompt injection has the same root cause — the model receives one continuous stream of text and has no hard architectural boundary between "the instructions I was configured with" and "the message a user just sent."

The difference is that SQL injection has a clean fix: parameterized queries separate code from data at the protocol level, and the vulnerability class is largely solved. There is no equivalent clean fix for prompt injection yet. A large language model reasons over natural language, and natural language is exactly the medium both the legitimate system prompt and the malicious user message are written in. You can't parameterize your way out of it the same way.

Direct vs. indirect injection

Direct prompt injection is what most people picture: a user types something like "ignore your previous instructions and do X" straight into the chat box. It's the easiest to defend against, because the text is visible, comes from an identifiable user, and modern safety training makes AI models reasonably resistant to naive versions of it.

Indirect prompt injection is the more dangerous variant, and it's the one causing real incidents in production right now. The attack payload isn't typed by the user at all — it's hidden in a document the agent reads, a support ticket it's asked to summarize, a webpage it fetches, or a tool's own description. The agent's owner never sees the injected text; only the model does, at the moment it processes that content. MITRE ATLAS tracks this separately as its own technique (indirect prompt injection) precisely because the detection and defense story is different from the direct case.

Why agents make this worse than chatbots

A chatbot that gets prompt-injected produces an embarrassing or wrong reply. An agent that gets prompt-injected can take an action — call a tool, escalate a request, read a file, send an email — because that's the entire point of giving it tools in the first place. The blast radius scales directly with what the agent is allowed to do, which is exactly why cross-agent privilege escalation (one compromised low-privilege agent handing a poisoned request to a second, more-privileged agent as a routine escalation) is one of the highest-severity findings in real assessments, not a theoretical one.

What actually reduces the risk today

There's no single fix, but there are real, measurable mitigations: keeping the most dangerous tool calls behind an explicit human-in-the-loop or a separate verification step rather than letting the model both decide and execute; treating anything the model reads from an external source (documents, tickets, web pages, tool outputs) as untrusted input, the same way you'd treat user-submitted HTML; and — the part most companies skip — actually testing the agent against real, documented injection techniques before shipping it, rather than assuming the model's own safety training is sufficient. It usually isn't, on its own, against a determined attacker who has more than one try.