In one sentence: Prompt injection is when someone writes text that tricks an AI tool into ignoring its instructions and doing something its owner did not intend.

What it is

OWASP, which lists it first (LLM01) in its Top 10 for large language model applications, says a prompt injection vulnerability occurs when user prompts alter an LLM’s behaviour or output in unintended ways. The inputs can affect the model even if people cannot see them, as long as the model reads them.

The NCSC explains the root cause: developers mix their own instructions with untrusted content in a single prompt, and then treat the response as if there were a robust boundary between what the app asked for and the untrusted content. Current language models do not enforce such a boundary.

How it works

1. A developer builds an AI feature: a chatbot, summariser or assistant. It has a hidden system prompt of instructions.
2. A user, or content the system reads, supplies text.
3. The model receives instructions and user text together and cannot reliably tell them apart. The NCSC says there is only ever “next token”, with no real distinction between data and instruction.
4. Crafted text changes behaviour. OWASP notes this can cause the model to break guidelines, generate harmful content, enable unauthorised access or influence critical decisions.
5. Impact depends on what the AI can do. OWASP’s glossary notes that an agent that cannot send email cannot be used to send phishing.

OWASP separates jailbreaking, a form of prompt injection that makes the model disregard its safety rules entirely. Retrieval-augmented generation and fine-tuning do not fully mitigate it, OWASP says.

Who it affects and how badly

Any organisation that builds or uses AI chatbots, copilots or agents, especially those connected to company data or able to act.

Sole traders using public chatbots risk leaking what they paste in. SaaS start-ups building customer-facing assistants risk data leaks and brand damage. Accountancy, legal and recruitment firms using AI on client documents risk exposure of confidential data. Regulated firms must consider UK GDPR and sector rules on automated processing. MSPs rolling out copilots must control what the assistant can reach.

The NCSC warns prompt injection may never be totally mitigated in the way SQL injection can be, and that if the system’s security cannot tolerate the remaining risk, it may not be a good use case for an LLM.

Real examples

EchoLeak, CVE-2025-32711, Microsoft 365 Copilot. Microsoft’s Security Update Guide lists CVE-2025-32711 as AI command injection in M365 Copilot allowing an unauthorised attacker to disclose information over a network. The academic case study says a single crafted email could make Copilot access internal files and send them to an attacker’s server without user interaction, and that this was disclosed by Aim Security in June 2025. Sources: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-32711 and https://arxiv.org/abs/2509.10540

How to detect it

• Log prompts, responses and every action the AI takes, such as emails sent, files read and web calls.
• Look for answers that reveal system instructions, include unexpected links or ask users for sensitive data.
• Review outbound connections from AI tools to new domains.
• In Microsoft 365, use Purview audit for Copilot interactions. Check what data Copilot can reach through sharing and permissions.
• Test your own AI features with harmless adversarial prompts as part of a security test.

How to fix or prevent it

1. Give the AI the least access it needs. OWASP calls privilege minimisation the most effective control.
2. Require human approval for sending, deleting, paying or changing records.
3. Treat all model output as untrusted before passing it to other systems.
4. Keep untrusted content clearly separate from your instructions, and limit what external content the model reads.
5. Filter inputs and outputs, but do not rely on filters. OWASP’s cheat sheet says input screening is not a security boundary.
6. Test regularly with adversarial prompts and a penetration test.
7. Design for impact reduction. The NCSC says to reduce risk and impact rather than hope for a fix.

Related terms

• indirect prompt injection
• owasp top 10 for llm applications
• data exfiltration
• SQL injection
• microsoft 365 security basics
• penetration testing methodology
• OWASP Top 10
• supply chain attack

Browse the full Resources library.

FAQ

What is the difference between prompt injection and jailbreaking? Jailbreaking is a form of prompt injection that makes the model disregard its safety protocols entirely, according to OWASP.

Can it be fixed like SQL injection? The NCSC says it may never be totally mitigated in the same way, so limit access and impact.

Where is it ranked? OWASP lists it as LLM01, the top risk for LLM applications.

How Wolfcore helps

A Wolfcore penetration test finds this the way an attacker would, by hand, not with a scanner. Start with the free web vulnerability scan at wolfcore.co.uk/free-web-vulnerability-scan and see Wolfcore penetration testing.