No control fully prevents prompt injection today, and OWASP says so plainly. The controls that work limit damage: least privilege for the model's tools, validated output formats, separated untrusted content and human approval for risky actions. Clever system prompts help a little and should never be your only layer.
This post reads OWASP's LLM01:2025 entry as a checklist and sorts the measures by how much weight they can carry. It contains no attack strings, on purpose.
What is prompt injection, in one paragraph?
OWASP defines it as user prompts altering the model's behavior or output in unintended ways, even when the input is invisible to humans, as long as the model parses it. Direct injection comes from the person typing. Indirect injection comes from content the model reads, such as a web page or a file. The impact depends on the business context and on how much agency you gave the model. A chatbot that only answers questions can embarrass you. An agent that can send mail and query data can hurt you.
Which controls carry real weight?
These are the ones that change the outcome even when the model is fooled.
Least privilege. OWASP advises giving the application its own API tokens, handling extended functions in code rather than handing them to the model, and restricting the model's access to the minimum needed. If the model cannot delete records, a hijacked model cannot delete records.
Human approval for high risk actions. Human in the loop for privileged operations stops an injected instruction from becoming an irreversible act.
Deterministic validation of output. Define the expected output format and check it with ordinary code. If the answer must be a JSON object with three fields, reject anything else before it touches another system.
Segregating untrusted content. Mark external content as untrusted and keep it apart from instructions to limit its influence.
Adversarial testing. OWASP recommends regular penetration testing and breach simulation, treating the model as an untrusted user to test trust boundaries and access controls.
Which controls help but cannot be trusted alone?
Constraining behavior in the system prompt. OWASP lists it first: define the role, capabilities and limits, and tell the model to ignore attempts to change core instructions. It raises the effort for an attacker. It does not create a boundary, because the model decides whether to follow it.
Input and output filtering. Semantic filters and string checks catch known bad patterns. OWASP also suggests the RAG Triad, scoring context relevance, groundedness and question and answer relevance, to spot suspicious outputs. Filters are a net with holes. Attackers who do not trigger your rules pass through.
RAG and fine-tuning. Teams sometimes expect grounding to fix this. OWASP states research shows RAG and fine-tuning do not fully mitigate prompt injection.
What fails in practice?
Three patterns show up in reviews.
Relying on a polite instruction as the security boundary. The text that sets the rules is processed in the same channel as the text that breaks them.
Giving agents broad credentials "for convenience", then discovering that every injected instruction runs with those credentials.
Testing only direct injection. Indirect paths, like a document or page the model summarizes, are where untrusted data enters most real systems. OWASP's own scenarios include a summarized web page that causes private conversation data to leak through an image link, and a modified document in a RAG repository.
Multimodal inputs widen the surface. OWASP notes instructions can hide in images alongside harmless text and says defenses here are still an area for research.
What to do
- Draw the data flow: every place text enters the model, including files, pages, tool results and other agents.
- List every action the model can trigger and remove any it does not need.
- Give the app, not the model, the credentials, and scope them tightly.
- Require human approval for anything destructive, financial or external-facing.
- Validate output with code against a strict schema before using it downstream.
- Mark retrieved and external text as untrusted and keep it apart from instructions.
- Add filters as a supporting layer and log what they block.
- Run red team exercises on indirect paths each release.
Quick check
Can a better system prompt stop prompt injection?
It can reduce easy cases. OWASP says it is unclear whether fool-proof prevention exists, so rely on limiting impact through privilege, validation and approvals.
What is the single most useful control?
Least privilege. A model that cannot take a damaging action cannot be tricked into taking it.
Sources
- OWASP LLM01:2025 Prompt Injection, fetched 18 October 2026
Last reviewed: 18 October 2026.
