Prompt Injection: How Attackers Hijack AI Assistants

What prompt injection is

Prompt injection tricks an AI assistant into treating attacker text as instructions. Language models follow text, and malicious instructions are also text. Think of it as slipping a fake sticky note into a stack of paperwork and hoping the assistant follows the note instead of company policy.

OWASP ranks it first, LLM01, in its 2025 Top 10 for LLM applications, because it affects almost every kind of AI system and is hard to fully prevent.

Direct and indirect attacks

Direct injection is typed straight into the assistant, for example into your website chatbot: a friendly request, a fake emergency or a role-play that tries to make the bot reveal internal rules, issue a refund or show another customer's details.

Indirect injection is hidden in content the assistant reads later, and the person using it may never see it:

Web pages: invisible text telling a research agent to favor one vendor.
Emails: instructions to forward the thread or draft an approval.
Documents: a resume that tells the screening AI to rate it highly.
Images: text inside a screenshot or scanned invoice that changes the answer.

The damage comes from connected tools

A chatbot that only answers public questions has limited risk; at worst it gives a bad answer. An assistant that can read customer records, send email, update a CRM or issue credits turns a successful injection into a real business action:

Leaking data: customer details, pricing notes or internal documents in a reply.
Sending messages: a forwarded private thread or a fake approval to a vendor.
Changing records: a complaint marked resolved, an address changed, misleading notes added.

The attacker does not break into your database. They persuade the assistant to misuse permissions it already has. Our guide to AI phishing emails covers the human side of the same trick.

Why no model fully prevents it

OWASP itself says it is unclear whether foolproof prevention exists. Attackers vary wording, languages and formats; filters that catch one pattern miss another; and a model cannot know every business rule about who may approve what. Retrieval and fine-tuning improve answers but do not close the hole. The realistic goal is layered defense: assume some injections get through and limit what they can do.

Defenses that work

Least privilege. A shipping-questions bot does not need HR files or invoice edit rights. Read-only where possible.
Human approval before sending, paying, refunding, deleting or changing payment details.
Treat outside content as data, not orders. Emails, web pages, PDFs and images are things to analyze, never instructions to obey.
Check outputs before they leave: scan for private data, block unknown links, enforce formats.
Log what the assistant read, which tools it called and who approved actions.
Have an off switch and know how to revoke its access fast.

A useful rule: never give an AI assistant more authority than you would give a brand-new employee with no supervision. Our guide to limiting AI agents goes deeper on permissions.

Questions for your AI vendor

How do you separate system instructions, user messages and outside content?
Can we restrict the assistant to specific folders, inboxes or actions, read-only where possible?
Which actions can require human approval?
Do you log retrieved content, tool calls and approvals?
How do you test for indirect prompt injection?
Can we switch off features we do not need?

Be wary of any vendor that promises total immunity. A good one explains its layers and its limits.

Where ASL fits

ASL Help Engine answers only from your reviewed sources, cites every claim and stays silent when the material does not support an answer. Across our platform, products fail closed when authorization is missing. Our custom software development team builds AI features with least privilege, approvals and audit logs from the start. Contact us to talk it through.

Frequently asked questions

What is prompt injection?

An attack that slips instructions into what an AI assistant reads, so it ignores its intended rules and follows the attacker instead.

What is indirect prompt injection?

Instructions hidden in content the AI processes later, such as a web page, email, document or image, often invisible to the person using the assistant.

Can prompt injection be fully prevented?

Not by the model alone. OWASP says foolproof prevention may not exist, so businesses limit permissions, require approvals, check outputs and keep logs.

Is my website chatbot at risk?

The risk grows with what the bot can access and do. A bot that only answers public questions is lower risk than one that reads records or issues refunds.

What is the single most useful defense?

Least privilege combined with human approval for important actions, so even a successful injection has little it can do.

Related guides

Explore the complete product

Read features, current access and limitations