Prompt injection
indirect prompt injection · LLM prompt injection · jailbreak · LLM01 · injection de prompt
An attack that hides instructions in the text a generative AI processes (a message, web page, document or email) to make it ignore its own rules and act in the attacker’s interest.
In practice
A large language model cannot reliably tell its designer’s instructions apart from the data it reads. Injection is direct when the user types the instructions in, and indirect when they are hidden in content the AI consults. The risk changes scale once the assistant can take actions: sending emails, reading files, calling APIs. It is the number one risk (LLM01:2025) in the OWASP Top 10 for LLM Applications, which admits it is unclear whether any fool-proof defence exists.
Fictional case: an AI assistant summarises a finance director’s emails. One incoming message contains, in white text on a white background, an instruction to forward the latest bank statements to an outside address. If the assistant can send emails without human approval, it may well obey.
How to protect yourself
- Give the AI minimal privileges and require human approval for any sensitive action.
- Treat all external content (web pages, documents, emails) as untrusted and keep it clearly separate from instructions.
- Validate the AI’s outputs with deterministic code before using them.
- Put your assistants through dedicated adversarial testing on a regular basis.
