For Heads-of · Practitioner
Prompt injection
Attacker-controlled input overrides system instructions, either directly or via retrieved/tool content treated as trusted.
- high
- llm
- input-handling
- owasp-llm
How it happens
Attacker-controlled text — direct user input or content retrieved via RAG/tools — is interpreted as an instruction rather than data, overriding the system prompt.
Why it matters
A successful injection can exfiltrate data, trigger unauthorised tool calls, or produce harmful output that still looks like a normal model response.
Mitigating controls
The controls that address this risk, ranked by effectiveness.
Framework and clause references
| Framework | Clause | Title |
|---|---|---|
| OWASP Top 10 for LLM Applications | LLM01 | Prompt Injection |