What is prompt injection?
Prompt injection is an attack where instructions hidden in content an AI agent reads (an email, a web page, a submitted form) override the rules its operator set. OWASP tracks it as LLM01. The control that matters is not detection but what the agent can reach, call, and send once injected.
What prompt injection actually attacks
Prompt injection works because an LLM cannot reliably separate instructions from data. The system prompt, the user request, and the email body the agent just read all arrive as the same tokens. OWASP tracks this as LLM01:2025 and splits it two ways: direct injection, typed by the user, and indirect injection, planted in a web page, document, repository issue, or inbound email the agent reads later. Indirect is the one that matters for deployed agents, because the attacker never needs an account.
Why input filtering is not the control
Microsoft shipped a cross prompt injection attempt (XPIA) classifier in 365 Copilot. EchoLeak (CVE-2025-32711) evaded it, slipped reference-style markdown past link redaction, and exfiltrated session data from one crafted email with no user interaction. Invariant Labs showed the same shape through the GitHub MCP server: a malicious issue in a public repo drove Claude into leaking private repository details. Classifiers raise attacker cost. They do not hold a boundary, and OWASP says fool-proof prevention is unclear.
What to control instead
Score the deployment against the lethal trifecta: access to private data, exposure to untrusted content, and a channel to send data outward. All three present means an exfiltration path exists, and removing any one closes it. Controls that survive review: least-privilege tool scopes per agent, human approval on writes and outbound sends, egress allowlists covering URLs and auto-fetched images, and a log of every tool call the agent made.
Last updated: Aug 14, 2026