OWASP LLM Top 10 / LLM01
LLM01

Prompt Injection

Untrusted input — typed, retrieved, tool-returned, or hidden in an image or audio track — alters a model's behaviour, because an LLM makes no architectural distinction between instructions and data.

Source: OWASP Top 10 for LLM Applications 2026 (CC BY-SA 4.0) — condensed for clarity.
Overview

What it is

A prompt-injection vulnerability occurs when input to a model — direct user input, retrieved content, tool output, an image, audio or video, intermediate reasoning, or persistent memory — changes the model's behaviour in ways the developer never intended. Because an LLM treats instructions and data as the same token stream, there is no clean equivalent of a parameterised query. The malicious input need not be human-readable, need not come from the user, and need not be visible in the rendered interface.

Three deployment properties make it worse. Context-window pooling means the system prompt, user input, retrieved documents, tool outputs, history and memory share one stream with no enforced trust boundary. Memory persistence means a single poisoned entry in long-term memory or a RAG corpus taints every future session that reads it. Agentic execution means that once model output drives tool calls — shell, file system, email, cloud APIs, MCP servers — the blast radius extends to whatever those tools can reach.

The 2026 entry explicitly broadens to cross-modal and steganographic attacks (instructions hidden inside images or audio below the human threshold) and to agentic kill-chains that spread across sessions and agents.

This differs from LLM02 Sensitive Information Disclosure (what the model leaks in its outputs) and LLM03 Excessive Agency (the consequences when model output reaches privileged actions). This entry concerns the input boundary itself; sanitising outputs before they reach downstream systems is LLM10 Improper Output Handling.

Attack surface

Common examples

  • Direct input override: a user message overrides the system prompt's role and limits, making the model disclose, generate, or act outside its intended scope.
  • Indirect injection through retrieved content: attacker instructions ride inside a RAG passage, web page, document, or email and run when that content reaches the context window.
  • Trusted-surface injection: text planted in a low-privilege but trusted channel (issue tracker, support ticket, feedback form) makes the user's own agent act under its elevated credentials.
  • Multimodal and steganographic injection: sub-perceptual perturbations in an image or audio clip are extracted by the model's encoder and change its behaviour.
  • Invisible-character smuggling: tag-block, variation-selector, and zero-width Unicode carry instructions or exfiltrate bytes inside benign-looking text (the 2024 M365 Copilot ASCII-smuggling proof of concept leaked a Slack MFA code).
  • Cross-session memory and RAG poisoning: one tainted entry reaches every future session that reads it — as few as five poisoned documents have reached ~90% success against a knowledge base of millions.
  • Encoded and low-resource-language payloads: Base64, ROT13, emoji, or code-mixed inputs bypass classifiers that never saw the scheme.
Defense

Prevention & mitigation

  • Assume the boundary will be bypassed. No reliable prevention exists today (a position shared by NIST and the NCSC). Defend architecturally: constrain what the model may do and what its output may reach, so a successful injection is not a successful exploit.
  • Constrain role and capabilities. Use declarative allow/deny statements in the system prompt (“assist with X only, never forward output externally”) — a partial control that must be paired with real privilege limits.
  • Hold credentials in application code, not the model. Grant least privilege per operation and route privileged calls through a deterministic policy engine that re-validates intent and arguments at execution time.
  • Validate output against a strict schema. Check every response in trusted code before any downstream system acts on it — structural validation catches format violations, though not semantic manipulation.
  • Filter at every modality boundary. Run modality-specific classifiers, OCR over images and transcription over audio, then apply text filters to the extracted content — not just to text.
  • Strip invisible characters. Remove tag-block, variation-selector, and zero-width Unicode at every ingest and render boundary.
  • Require human confirmation for privileged actions. Surface the exact rendered action, not a summary, before anything irreversible or externally visible executes.
  • Budget agent capability with the Rule of Two. Treat simultaneous access to untrusted input, sensitive data, and external communication as high-risk; any such agent needs per-action human approval.
  • Treat memory writes as privileged. Log the causing prompt, classify writes for instruction content, and require approval before instruction-bearing memories persist.
  • Test against adaptive attackers. Red-team with the full defence disclosed to testers; static attack-success near zero routinely becomes 90%+ under adaptive attack.
In the wild

Example attack scenarios

  1. An attacker tells a support chatbot to ignore its guidelines, query private data stores, and send email, leading to unauthorised access and privilege escalation.
  2. A user asks an assistant to summarise a web page carrying hidden instructions; the model inserts a markdown image whose URL exfiltrates the private conversation to an attacker domain.
  3. A job-description PDF embeds an AI-detection instruction; an applicant unknowingly uses an LLM to optimise their resume against it and the recruiting system flags them — injection with neither party acting maliciously.
  4. An attacker contributes poisoned documents to a corpus the application retrieves over; a matching query returns the modified content and its instructions alter the output.
  5. A multimodal model's vision encoder extracts an instruction hidden in an image below the visual threshold, producing harmful output or an unauthorised tool call.
  6. A crafted email triggers a productivity assistant to exfiltrate organisational data with no user interaction, bypassing the deployed prompt-injection classifier and link-redaction filter.
  7. Text planted in a public GitHub issue is read by a developer's MCP-connected agent under elevated credentials, dumping a production database the attacker could not reach directly.
Further reading

References

  • OWASP Top 10 for LLM Applications 2026 — LLM01:2026 Prompt Injection: genai.owasp.org
  • NCSC — Thinking about the security of AI systems (2025)
  • Simon Willison — The lethal trifecta for AI agents (2025)
  • Nasr et al. — Adaptive attacks on prompt-injection defences (2025)
  • Meta AI — The Agents Rule of Two (2025)
  • Debenedetti et al. — AgentDojo: evaluating prompt-injection defences (2024)

How Neural Industries helps. We test, exploit, and remediate prompt injection across text, tool, memory, and multimodal surfaces as part of a full OWASP LLM Top 10 assessment — then hand you the evidence to prove it.

Request an assessment →