Prompt injection is a vulnerability where input changes a large language model's behavior or output in unintended ways. OWASP notes the input does not need to be visible to a person. It only needs to be parsed by the model. There are two forms, direct and indirect.
Direct prompt injection
In the direct form, a user's own input alters the model's behavior. It can be deliberate, such as an attacker crafting a prompt to override instructions, or accidental, where an ordinary message happens to change how the model behaves.
Indirect prompt injection
In the indirect form, the model takes in outside content, such as a web page or a file, and that content contains instructions that change its behavior. The user never typed the attack. The model read it.
This is the form that matters most for agents. An assistant that browses pages, reads email or opens documents will meet text written by strangers, and it may treat that text as instructions.
Why it is hard to fully prevent
A model processes instructions and data in the same stream of text. There is no reliable hard boundary inside the model between "what the developer said" and "what the page said." That is why defenses focus on limiting what a fooled model can do.
Mitigations OWASP lists
OWASP's guidance includes these steps:
- Constrain model behavior with a clear role, limits and instructions to ignore override attempts.
- Define expected output formats and validate them with deterministic code.
- Filter inputs and outputs for sensitive or disallowed content.
- Enforce least-privilege access and handle privileged functions in code, not through the model.
- Require human approval for high-risk actions.
- Separate and clearly label untrusted external content.
- Run regular adversarial testing, treating the model as an untrusted user.
What to do first
If you can only do two things, do 4 and 5. A model that cannot delete records or send money cannot be tricked into doing so, and a person who must approve the risky step catches many mistakes. See what MCP is for how tool access gets wired up.
Safeguard offers an MCP Guardrail and agent identity controls to govern what agents can reach. Try a free scan of your own dependencies at gold.safeguard.sh/scan.
Quick check
Can a system prompt alone stop prompt injection?
No. Instructions help, but OWASP pairs them with output validation, least privilege and human approval.
What makes indirect injection different?
The malicious instruction arrives in external content the model reads, not in the user's own message.
Sources
Last reviewed: 19 October 2026.
