Prompt injection

An attack in which a malicious instruction is hidden in content an AI reads (a web page, a document, an email, a data field) to hijack its behavior. It is LLM01, the top-ranked entry in OWASP's Top 10 for LLM Applications (2025). For an agent, which holds tools, an injection can become a real action rather than just a wrong sentence, which is why OWASP's Top 10 for Agentic Applications (December 2025) carries it forward into tool-level risks like goal hijack and tool misuse.

A technique in which an attacker embeds instructions inside content an AI system will read (a document, a webpage, an email) so the system follows the attacker's hidden instructions rather than, or in addition to, its intended task. Related to poisoning but distinct: prompt injection attacks the system at inference time through content it reads, not through its training data.

A technique by which an attacker crafts input to a deployed AI system designed to manipulate the system into revealing information or taking actions it was not intended to disclose or perform, a mechanism this topic classifies as squarely within scope for data breach notification analysis whenever personal information or important data is disclosed as a result.

An AI-specific attack in which an adversary crafts natural-language inputs to override or subvert a language model's intended instruction set, redirecting its outputs toward harmful or unauthorized ends; a material additional threat for high-risk AI systems that incorporate LLM or GPAI components, assessed alongside the five Article 15(5) named categories.

A hostile use of the user-prompt dial in which crafted input attempts to override the system prompt and pull the model off its intended behavior. Because the user prompt is a dial adversaries reach too, the system prompt and guardrails must be designed to withstand it. The deep treatment is owned by the red-teaming topic. (see Topic 4.3)