02 — attack concepts

Prompt injection

Getting a language model to follow instructions it was not supposed to follow, by placing those instructions somewhere the model treats as input. The root cause is that a model sees one undifferentiated stream of text: the developer's system prompt, the user's question, a web page it fetched and a file it read all arrive as tokens, with no reliable structural marker saying which of them is allowed to give orders. It splits into two shapes with very different threat models — direct and indirect.

See also jailbreak · OWASP LLM01 · confused deputy

Related terms

Jailbreak Attack concepts
Defeating a model's safety training so it produces output it would normally refuse. The distinction from prompt injection is about whose intent is being…
OWASP LLM Top 10 Frameworks & standards
OWASP's list of the ten most critical risks in applications built on large language models — LLM01 Prompt Injection, LLM02 Sensitive Information…
Confused deputy Attack concepts
A classic security problem, dated 1988, that agents reproduce almost perfectly: a privileged component is tricked by a less-privileged party into misusing…

Attack concepts

The mechanisms the families above exploit, plus the agent-specific ones that have no chatbot equivalent. If you only read one entry on this page, read indirect prompt injection.

Prompt injection is term 1 of 14 in this part of the glossary.

Prompt injectionDirect prompt injection Indirect prompt injection Jailbreak Obfuscation / encoding Homoglyph Leetspeak Multi-turn crescendo Tool poisoning Tool-name shadowing Capability expansion Confused deputy Data exfiltration Lethal trifecta

This page is one entry from the agentic AI security glossary, which defines 60 terms in the same style. Where a term belongs to a published taxonomy or standard — the HackAgent attack families, the OWASP lists, AMTSO's guidelines, MITRE ATLAS, ISO/IEC 42001, the NIST AI RMF, the EU AI Act — the authoritative wording is the source document's, not ours, and specifics should be verified there. "Lethal trifecta" is Simon Willison's term. OWASP® is a trademark of the OWASP Foundation; ATT&CK® and ATLAS™ are trademarks of The MITRE Corporation. Naming a framework here is description, not a claim of certification or endorsement.