Use prompt injection for any input that changes a model's behaviour in unintended ways. Use jailbreak for the subset that aims to make the model disregard its safety protocols entirely. OWASP says the two are related and often used interchangeably, but precision helps when you triage and report.
The definitions
OWASP defines prompt injection as user input that alters an LLM's behaviour or output in unintended ways. It describes jailbreaking as a form of prompt injection that aims to make the model disregard its safety protocols entirely.
So every jailbreak is a prompt injection. Not every prompt injection is a jailbreak.
A quick way to choose
Ask what the attacker was trying to achieve.
- Make the model produce content it is meant to refuse: better term Jailbreak
- Make an app leak data or run an action through the model: better term Prompt injection
- Hidden instructions in a web page or file steer the model: better term Indirect prompt injection
- User message directly changes behaviour: better term Direct prompt injection
OWASP separates direct injection, where user input changes behaviour, from indirect injection, where the model ingests external content such as websites or files that carry instructions.
Why the difference matters
Triage. A jailbreak on a chatbot with no tools is mostly a content and reputation issue. An injection in an agent with tools can mean data loss. Using the broader term for the second case keeps people from underrating it.
Ownership. Content safety problems often sit with a model or trust team. Injection that reaches tools and data sits with application security and platform owners.
Controls. Both benefit from narrow permissions and output checks. Jailbreaks lean on model level safety tuning and content filters, while injection into tool using apps leans on privilege control, approval and isolation of untrusted content.
Wording for reports
State the vector (direct or indirect), the goal (policy bypass, data access, action) and the impact (what actually happened). A line such as "indirect prompt injection through a support ticket led the assistant to include internal notes in a reply" says more than "the model was jailbroken".
Keeping audits tidy
Use one category name in your risk register so incidents can be counted. Add the sub-type in a field. Mapping to OWASP's LLM01 entry gives reviewers a shared reference.
Safeguard's policy and guardrail features are relevant to the injection side, where the question is what an agent is allowed to do.
Common confusion. People often say jailbreak for any attack on an AI system, including attacks on the surrounding application. If the weakness was in permissions, rendering or data access, the model did not fail alone. Calling it a jailbreak can send the fix to the wrong team. Name the real failing control in the report.
Quick check
Is a jailbreak always harmless without tools?
No. It can still produce harmful content or expose a system prompt, so assess the impact case by case.
Sources
Last reviewed: 19 October 2026.
