# What is Prompt Injection?

> Prompt injection is the manipulation of a generative AI system through instructions that cause a model to override or conflict with the application’s intended instructions.

- Canonical URL: https://yellowcube.eu/glossary/prompt-injection/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

It exploits the difficulty of reliably separating trusted directions from untrusted content in the model’s context. A direct injection comes from the interacting user; an indirect injection is planted in content the system later processes, such as a webpage, email, document, image, tool result or retrieval record.

The consequence depends less on the text alone than on the application around the model. An isolated assistant might produce an unwanted answer, while an agent with access to private data, credentials or external tools could disclose information or initiate unauthorized actions. Defenses should therefore assume that crafted content may influence the model and limit what any resulting output is allowed to do.

### Key points

- **Trust boundaries:** Identify every path that adds text, images, retrieved records or tool output to context, and label external content as untrusted even when it appears inside a familiar document.
- **Impact reduction:** Give models and tools least-privilege identities, separate sensitive data, constrain available actions, validate tool arguments and require independent approval for high-impact operations.
- **Detection and testing:** Exercise direct, indirect, encoded, multilingual, multimodal and multi-step cases; log the model, prompt, retrieved content, tool calls and authorization decisions needed to investigate results.
- **Important limitation:** System prompts, input filters, delimiters and model-based detectors can reduce risk but do not provide a universal prompt-injection boundary. The application must remain secure when the model follows hostile instructions or emits hostile output.

### Related terms

[Data poisoning](<https://yellowcube.eu/glossary/data-poisoning/>) · [Least privilege](<https://yellowcube.eu/glossary/least-privilege/>) · [AI red teaming](<https://yellowcube.eu/glossary/ai-red-teaming/>) · [Agentic AI security](<https://yellowcube.eu/glossary/agentic-ai-security/>)

### Sources

[NIST AI 100-2 E2025, Adversarial Machine Learning Taxonomy](https://csrc.nist.gov/pubs/ai/100/2/e2025/final) · [OWASP LLM01:2025 Prompt Injection](https://genai.owasp.org/llmrisk/llm01-prompt-injection/) · [MITRE ATLAS](https://atlas.mitre.org/)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.