Prompt injection
Text hidden in content an AI reads, such as a web page, document or photo, that tries to override its instructions and make it do something else.
Updated October 2026 · with examples from our own builds
What does prompt injection mean in practice?
Language models can't reliably tell instructions from data. If an AI reads a web page, an email or the text on a card, and that content says 'ignore your instructions and do this', the model may comply. OWASP lists prompt injection first among the risks to LLM applications.
The danger grows with what the AI is allowed to do. A model that only fills in fields can at worst fill one wrongly; a model that can click buttons, send messages or spend money can be steered into doing those things.
Defence is a matter of design, not a cleverer prompt: treat everything the model reads as untrusted, constrain its output to a strict format, and never let its output alone choose an action that matters.
Prompt injection at a glance
- Arrives through
- Any content the AI reads
- Worst when the AI can
- Act, not just answer
- Main defence
- Model output never chooses consequential actions
Where has prompt injection come up in our builds?
When AlwaysLoud explores a customer's app, a vision model may suggest which controls to open, but it can only reorder and prune; advice to press a denied control changes nothing, and a test plants exactly that advice to prove it.
The card reader lets the model transcribe what is printed into a strict JSON schema and lets code decide what is true, so whatever a card says, the reply can only fill fields that code then checks.
Common questions about prompt injection
Can a better prompt prevent prompt injection?
Not reliably. Instructions help, but the dependable defences are structural: strict output formats, checks in code, and no consequential action taken on the model's say-so alone.
Is my chatbot at risk if it only answers questions?
The risk is lower, but it can still be steered into saying things you wouldn't publish, such as false offers or off-topic content. Topic guardrails and a handover to a person limit the damage.
Related terms
Sources
Planning a product and not sure where prompt injection fits? Ask us, or browse all 116 terms in the glossary.