02 — attack concepts

Direct prompt injection

The person typing is the attacker. They write instructions intended to override the system prompt or the product's guardrails — "ignore your previous instructions", a DAN persona, an encoded payload — straight into the input box. The threat model is an insider or a user abusing a product they have legitimate access to, so the harm is usually policy violation, quota abuse or extraction of a system prompt rather than compromise of another party.

Related terms

Indirect prompt injection Attack concepts
The instructions are planted in content the agent reads rather than text the user types — a web page, a GitHub issue, a code comment, a dependency's…
Jailbreak Attack concepts
Defeating a model's safety training so it produces output it would normally refuse. The distinction from prompt injection is about whose intent is being…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Direct prompt injection is term 2 of 14 in this part of the glossary.

Prompt injectionDirect prompt injectionIndirect prompt injection Jailbreak Obfuscation / encoding Homoglyph Leetspeak Multi-turn crescendo Tool poisoning Tool-name shadowing Capability expansion Confused deputy Data exfiltration Lethal trifecta

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.