Understanding prompt injection

Lesson 2 of 8 · 40 min · part of the AI Security Professional certification

Prompt injection is manipulating an LLM with crafted input so that it ignores its intended instructions and follows the attacker's instead. It is ranked #1 in the OWASP LLM Top 10.

It works because a model receives the developer's system prompt and the user's (or a document's) text as one stream of tokens. There is no reliable, built-in way for the model to know which text is "allowed" to give orders.

• Direct injection — the attacker types the malicious instruction themselves ("Ignore previous instructions…").
• Indirect injection — the instruction is hidden in content the model processes: a web page, email, PDF, or retrieved document.
• Jailbreaking — a form of direct injection aimed at bypassing safety policies, often via role-play or hypothetical framing.
• System prompt leakage — tricking the model into revealing its hidden instructions (and any secrets wrongly stored there).