Prompt injection is the most important security problem in AI applications, and it gets more serious as AI moves from chat to agents that read email, browse the web, edit code and call tools. OWASP ranks it first in its Top 10 for LLM Applications. This guide explains what prompt injection is, how real attacks have worked, why it is hard to fix and the practical defenses that reduce the risk in 2027.
What Is Prompt Injection?
Prompt injection happens when text supplied by someone other than the user changes what an AI model does. Language models read instructions and data in the same stream of text, so a model can be tricked into treating attacker-written content as a command. The term was coined in 2022, by analogy with SQL injection, where data is mistaken for code.
The consequences depend on what the AI can do. A chatbot might only say something embarrassing. An agent with access to email, files, code or payment tools might leak data, send messages or take actions the user never asked for.
Direct vs Indirect Prompt Injection
Direct prompt injection, often called jailbreaking, is when the user types instructions meant to override the system’s rules, such as telling a support bot to ignore its policies.
Indirect prompt injection is more dangerous. The malicious instructions are hidden in content the AI reads while doing its job: a web page, an email, a PDF, a calendar invite, a code comment, a GitHub issue or an MCP tool description. The user never sees the attack, and the AI follows it while believing it is helping.
Real Prompt Injection Attacks
Zero-Click Data Theft From An Office Assistant
In 2025 researchers disclosed EchoLeak, a flaw in Microsoft 365 Copilot. An attacker could send an email containing hidden instructions; when the user later asked Copilot an ordinary question, the assistant could pull in that email and be steered into leaking internal data, without the user clicking anything. Microsoft fixed the issue, but it showed how an assistant with access to mail and files becomes a target.
Private Repositories Leaked Through An Issue
Also in 2025, researchers showed that an agent connected to GitHub through an MCP server could be manipulated by a malicious issue in a public repository. When a developer asked the agent to look at open issues, the hidden instructions led it to read private repositories and publish their contents in a public pull request.
Poisoned Tool Descriptions
MCP servers describe their tools in text the model reads. Researchers have demonstrated tool poisoning, where a malicious or compromised server hides instructions in a tool’s description, telling the agent to send files or credentials elsewhere. Our guide on how to audit an MCP server before you install it covers how to check for this.
Why Prompt Injection Is Hard To Fix
There is no reliable way for today’s models to separate trusted instructions from untrusted data, because both are just text. Filters and classifiers catch many known patterns, but attackers can rephrase, translate, encode or hide instructions in ways a filter has not seen. That is why security researchers treat prompt injection as a risk to be contained, not a bug to be patched once.
A useful way to judge exposure is to look for three ingredients together: an AI that can access private data, that reads untrusted content, and that can send data out or take external actions. When all three are present, a successful injection can cause real harm. Removing any one of them sharply reduces the risk.
How To Defend Against Prompt Injection
Limit What The AI Can Do
The strongest defense is least privilege. Give agents only the tools and data each task needs, prefer read-only access and make high-impact tools, such as sending email, moving money or deleting records, require explicit human approval.
Separate Untrusted Content
Treat everything the AI reads from outside as untrusted. Mark it clearly in prompts, keep it away from sensitive tools where possible and avoid letting one agent both read public content and act on private systems in the same session.
Screen Inputs And Outputs
Use classifiers and guardrails to catch known injection patterns and to check outputs for leaked secrets or suspicious links. Our list of open-source AI guardrails and our list of AI security companies protecting LLMs and AI agents cover the main options.
Control Outbound Channels
Many attacks end with data leaving through a link, an image URL, an email or a web request. Restrict which domains an agent can reach, strip or rewrite external links in outputs and run code in sandboxes with deny-by-default networking.
Vet Tools And MCP Servers
Install servers only from publishers you trust, pin versions and review tool descriptions. Route tool traffic through one of the MCP gateways we compare so allow-lists and logs live in one place.
Test Continuously
Run red-team tests whenever prompts, models or tools change, using tools such as Promptfoo, garak or PyRIT, or bring in specialists from our list of AI red teaming companies.
Monitor And Log
Record prompts, tool calls and results so you can spot unusual behavior and investigate incidents. For developer machines, our list of security tools for AI coding agents covers tools that watch what agents actually run.
Prompt Injection vs Jailbreaking
The terms overlap. Jailbreaking usually means a user persuading a model to ignore its safety rules. Prompt injection is broader and includes attacks where the instructions come from third-party content the user never wrote. For businesses deploying agents, indirect injection is the bigger concern.
Frequently Asked Questions
Can Prompt Injection Be Completely Prevented?
Not with current models. Defenses reduce the likelihood and the damage, which is why limiting permissions and requiring approval for risky actions matters more than any single filter.
Are AI Coding Agents Vulnerable?
Yes. Coding agents read code, issues, documentation and web pages, and they can run commands, so a hidden instruction in any of those can lead to real actions on a developer’s machine.
Does Using A Better Model Fix It?
Newer models resist many attacks better, but none are immune. Treat model improvements as one layer, not the solution.
What Is The First Thing To Do?
List every AI system that combines private data, untrusted content and the ability to send data or act externally, and remove or gate one of those three for each.
Conclusion
Prompt injection exists because AI models cannot reliably tell instructions from data. As assistants become agents, that weakness turns into a path to data theft and unwanted actions. The answer is defense in depth: least privilege, human approval for risky actions, screening, outbound controls, trusted tools and continuous testing. Our AI agent security checklist brings these steps together.
