Risk · Model & Application Security

Prompt injection

Attacker-controlled input overrides system instructions, either directly or via retrieved/tool content treated as trusted.

high
llm
input-handling
owasp-llm

How it happens

Attacker-controlled text — direct user input or content retrieved via RAG/tools — is interpreted as an instruction rather than data, overriding the system prompt.

Why it matters

A successful injection can exfiltrate data, trigger unauthorised tool calls, or produce harmful output that still looks like a normal model response.

Mitigation

Mitigating controls

The controls that address this risk, ranked by effectiveness.

supporting

Human-in-the-loop review

Mandatory human approval gate for high-consequence or irreversible AI-generated actions before they take effect.

primary

Output validation and guardrails

Deterministic schema validation and sanitisation of AI-generated output before it reaches any downstream system.

Regulatory context

Framework and clause references

Framework	Clause	Title
OWASP Top 10 for LLM Applications	LLM01	Prompt Injection

Back to the risk library