Prompt Injection Attacks on AI Models: How They Work and How to Defend Against Them

Prompt injection is a security vulnerability where untrusted text overrides a developer's instructions to a large language model, causing it to behave in unintended ways. The attack takes two forms: direct injection, where a user types malicious instructions, and indirect injection, where harmful commands are hidden inside documents, web pages, or emails that an AI agent reads. Indirect injection poses the greater risk for AI agents and retrieval-augmented generation systems, as attackers can plant payloads in data sources without ever accessing the application directly. The vulnerability stems from how LLMs process input — instructions and data arrive as the same undifferentiated stream of tokens, giving the model no reliable way to distinguish between them. OWASP lists prompt injection in its 2025 Top 10 risks for LLM applications, and experts note there is no single fix, only layered defenses that limit potential damage.