Prompt injection (hidden instructions that fool AI)
Japanese プロンプトインジェクション
Prompt injection is an attack that slips hidden instructions into text or files an AI reads, to change what the AI does. It works because AI cannot cleanly tell material to read from orders to follow.
Prompt injection is an attack that hides instructions inside text, web pages or files that an AI reads while doing a job, so the AI acts in ways nobody intended. OWASP puts it first (LLM01) in its list of AI security risks. A direct injection comes from the person typing into the AI. An indirect injection comes from outside material, such as a website or a file, that carries the hidden instructions. It is like handing a messenger a note, and someone else adds a line at the bottom: send this money too.
Watch out The UK NCSC explains that an AI cannot reliably separate material from instructions, so the risk is hard to remove completely. It is more realistic to limit what the AI is allowed to do, and to have a person check anything that moves money or sends data out.
Source: LLM01:2025 Prompt Injection · Prompt injection is not SQL injection (it may be worse) · Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (checked 2026-10-26)