What Is Prompt Injection? Understanding the Top Threat to AI Systems

What makes prompt injection distinct from a simple mistake or accidental misuse is intent and mechanism. The AI is not misunderstanding a well-formed request. It is following instructions that were never authorized, placed there by someone who wants to change its behavior. These inputs can influence a model even when they are imperceptible to a human reader, because prompt injection does not depend on the content being visible or readable to a person. It only depends on the content being parsed by the model.

This is why prompt injection is considered the most important threat to systems that are built on AI, sitting at the top of the OWASP Top 10 for Large Language Model Applications as LLM01:2025. It exploits a fundamental characteristic of how language models work: they interpret natural language instructions wherever those instructions appear, whether in a system prompt, a user message, a retrieved document, or a file. For a deeper technical breakdown, see how prompt injection attacks work.

Why prompt injection matters more than ever

For most of the generative AI era, a prompt was a request and the response was text. You asked a chatbot a question, and it answered. If the answer was wrong, the cost was, more often than not, just inconvenience. That equation has changed with the rise of agentic AI.

Agentic AI systems do not simply respond. They take action in real systems to accomplish a goal. Instead of the application calling the AI as a background feature, the AI becomes a client that accesses applications directly, querying databases, initiating transactions, modifying configurations, and communicating with external parties. The key enabling technology behind this shift is the Model Context Protocol (MCP), which became broadly available in 2025 and gives AI systems a standard way to connect to external software. With a set of connected MCP servers, an assistant can move from answering to acting.

That shift reframes what a prompt is. A prompt is no longer a line of dialogue; it is a directive, a command, effectively a non-deterministic program written in natural language. And organizations are moving quickly in this direction. The vast majority of organizations plan to invest more in agentic AI, drawn by productivity gains that leaders compare to adding net-new headcount.

When a prompt becomes a program, prompt injection stops being about a wrong answer and starts being about unauthorized action with material consequences. The stakes are no longer whether the output reads well. They are whether an autonomous system just did something it should never have been allowed to do.

Prompt injection vs. traditional software attacks

The security community has faced a version of this problem before. In traditional software, organizations do not let arbitrary code run in their environment. They ensure that only authorized, signed executables are run, using mechanisms such as Windows User Account Control that verify a program is both approved and unmodified before it is executed. Sign the software, verify the signature, and you gain confidence that what is running is what was intended.

Prompt injection is the natural language equivalent of injecting malicious instructions into an authorized application. When the “program” is a directive written in prose rather than compiled code, the same core concern applies: only authorized instructions should execute, and those instructions should not have been tampered with along the way. If anything, the concern grows, because natural language is more fluid and harder to constrain than compiled binaries.

This parallel points toward a familiar class of solution. Just as code signing establishes that an executable came from a trusted source and has not been altered, cryptographic approaches can help establish that an AI directive is authentic and unmodified. That analogous solution is explored in depth on our prompt signing page. The important idea here is simply that ensuring only authorized instructions run is a challenge both paradigms share.

Types of prompt injection

Prompt injection is not a single technique. Industry frameworks such as OWASP LLM01:2025 describe two main categories, defined by where the malicious instruction enters the system.

Direct prompt injection

Direct prompt injection occurs when a user’s input directly alters the model’s behavior in unintended or unexpected ways. This can be intentional, where a malicious actor deliberately crafts a prompt to exploit the model, or unintentional, where a user inadvertently supplies input that triggers unexpected behavior. A classic example is an attacker instructing a customer support chatbot to ignore its previous guidelines and reveal private data.

Indirect prompt injection

Indirect prompt injection occurs when a model accepts input from external sources such as websites or files, and that external content carries instructions that alter the model’s behavior when interpreted. For instance, a document retrieved to answer a question might contain hidden text that redirects the model. Because the instruction rides along inside data the model was asked to process, the user may never see it. The rise of multimodal AI, which handles several data types at once, widens this surface further: an attacker can hide instructions inside an image that accompanies harmless text, producing cross-modal attacks that are difficult to detect with current techniques.

In both of these scenarios, the impact of a successful attack varies with the business context and the level of agency the system is given. Common outcomes include disclosure of sensitive information, exposure of system prompts or infrastructure details, manipulation of outputs, unauthorized access to functions available to the model, execution of arbitrary commands in connected systems, and interference with critical decision-making.

What makes prompt injection dangerous in agentic AI and the multi-agent challenge

In a chatbot, a successful prompt injection might produce a misleading paragraph. In an agentic system, the same attack can trigger consequences that reach into the real world. Because agents can execute unauthorized database queries, initiate financial transactions, or change infrastructure configurations, a single injection can lead to service outages, data loss, failed compliance audits, and lasting loss of customer trust. In cyber-physical settings, where software controls equipment, the potential outcomes extend to physical safety risks.

A defining property of this danger is that it scales with autonomy. The more independent decision-making an organization grants an agent, and the broader the set of systems it can touch, the larger the blast radius of any instruction that slips through. An agent that can only draft text is low-risk. An agent that can move money or reconfigure production systems is not.

The risk compounds in multi-agent architectures. In these systems, one agent frequently passes data or instructions to another, which passes to a third, and so on. Along the way, the context about which parts of the data were user-submitted and untrusted, versus system-generated and trusted, can be lost. This resembles a game of telephone: by the time an instruction reaches an agent several hops down the chain, the information needed to tell a legitimate directive from an injected one may be gone. A single injection point can therefore propagate unauthorized instructions across an entire chain, with each agent having less ability than the last to catch the problem.

Concrete illustrations of how these attacks play out include an attacker planting hidden instructions in a webpage so that an AI summarizing it exfiltrates a private conversation, or modifying a document in a knowledge repository so that a retrieval-augmented application returns manipulated results. These scenarios, documented by OWASP, show how ordinary content becomes an attack vector once an agent is empowered to act on it.

How prompt injection fits in the broader AI threat landscape

Prompt injection is the most prominent threat to agentic AI, but it is not the only one. Understanding where it sits helps clarify why no single control is sufficient. Agentic systems face a related set of threats, each distinct from prompt injection in origin even when the damage looks similar:

• Man-in-the-middle attacks on directives: interception and modification of instructions as they travel across networks between origin systems and the agent runtime.
• Replay attacks: resubmission of a previously authorized directive to trigger an unauthorized repeat of an action.
• Insider threats: authorized users issuing directives outside their sanctioned scope.
• Compromised upstream systems: legitimate integration points that have been taken over and now issue malicious directives.
• Social engineering: manipulation of the human operators who approve or issue directives.

Prompt injection is different from each of these, not only mechanically, but also in nature.Mechanically, a prompt injection attack hides unauthorized instructions inside data the agent processes, rather than intercepting a directive in transit, replaying an old one, or manipulating a person. In nature, prompt injection attack is the most fundamental, as it can be found as part of, or combined with, any of these attacks. Moreover, the categories overlap in effect, which is precisely why defenders cannot rely on one mechanism. Addressing this full landscape requires a layered approach to prompt security, where complementary controls each cover threats the others miss.

A real world example

OpenClaw is an open-source AI agent framework. It was created by developer Peter Steinberger (now at OpenAI), released in late 2025 under the name Clawdbot, and after a couple of renamings it grew from roughly 9,000 GitHub stars to 60,000 within three days, eventually becoming one of the most-starred projects on the platform. Its appeal is that it acts rather than advises: a user connects it to an inbox, files, and a browser, describes a task in plain language, and the agent carries it out on their behalf. That capability is what made it a useful test subject. Researchers at Varonis set out to answer a straightforward question: do the phishing techniques that have worked against people for decades also work against the agents now acting for them?

They built an agent, gave it an email account and access to a synthetic company’s internal data, and sent it a series of phishing messages. The agent handled the technical lures well. A suspicious link, a fake login page, and a malicious OAuth application disguised as a timesheet tool were each inspected and rejected. It performed very differently when the attacker skipped the technical component and simply wrote a convincing email. A message from someone impersonating a team lead, citing a production issue and requesting staging access, prompted the agent to locate credentials and send them to an external address. A second message, from someone claiming to be working remotely and needing the customer list for a presentation, produced the customer list. No malware and no exploit were involved, only a plausible pretext and a sense of urgency. The most significant finding for anyone deploying these systems is that a “strict” configuration, given explicit instructions to verify the sender’s identity before performing sensitive actions, failed in the same way. The email itself was the attack. The agent treated the incoming message as though it came from its operator, because it has no reliable means of distinguishing an instruction from its owner from text that merely resembles one, and once a request appeared urgent, the verification step it had been instructed to perform was skipped.

Prevention and mitigation strategies

Because prompt injection stems from the fundamental, probabilistic way generative models interpret language, which is the way how today’s generative models work, it cannot be fully eliminated with current architectures. OWASP notes that there is no known fool-proof method of prevention. What organizations can do is meaningfully reduce the attack surface and limit the damage of any injection that succeeds. OWASP LLM01:2025 recommends several measures:

1. Constrain model behavior.
   Give the model clear instructions about its role, capabilities, and limits in the system prompt. Enforce strict context adherence, keep responses scoped to defined tasks, and direct the model to ignore attempts to alter its core instructions.
2. Define and validate expected output formats. 
   Specify output formats, ask for reasoning and source citations, and use deterministic code to check that responses conform.
3. Implement input and output filtering. 
   Define sensitive categories, build rules to identify and handle them, apply semantic filters, and scan for disallowed content. Evaluating responses for context relevance, groundedness, and answer relevance helps catch potentially malicious output.
4. Enforce privilege control and least privilege access. 
   Give the application its own API tokens for extended functionality, handle those functions in code rather than exposing them to the model, and restrict the model’s privileges to the minimum required.
5. Require human approval for high-risk actions. 
   Put human-in-the-loop controls in front of privileged operations so that sensitive actions cannot proceed unchecked.
6. Segregate and identify external content.
    Clearly separate and label untrusted content so it carries less influence over the model’s behavior.
7. Conduct adversarial testing and attack simulations. 
   Run regular penetration testing and breach simulations, treating the model as an untrusted user to test trust boundaries and access controls.

Taken together, these measures form a defensive posture rather than a single fix. The directive authorization problem

Prompt injection is best understood as one symptom of a larger architectural question: how does a system know that the instructions an AI agent receives can be trusted? When an agent is handed a directive, several questions should be answered before it acts:

• Authenticity: Did this directive originate from a legitimate, authorized source?
• Integrity: Has the directive been modified since it was issued?
• Authorization: Is this source permitted to issue this type of directive?
• Timeliness: Is this directive current, or is it a replay of a previously authorized instruction?
• Semantic safety: Will acting on this directive align with organizational policy?

The central difficulty is that no single mechanism answers all five. Prompt whitelisting and templating are deterministic and auditable but grow unmanageable as use cases expand, and they block novel legitimate requests by default. One-time authorization codes provide replay protection and a clear audit trail but add a runtime dependency and simply relocate the human-approval problem. AI-based semantic gatekeepers understand intent and adapt to new situations, but they are non-deterministic, add cost, and introduce a new surface for injection themselves.

This is why robust designs layer complementary controls, each addressing part of the problem. Framing prompt injection this way, as a question of directive authorization, prepares the ground for understanding why foundational trust mechanisms are necessary. For a practical look at solutions, see preventing prompt injection attacks in agentic AI.

How Keyfactor can help

Keyfactor approaches prompt injection through cryptographic trust. The same pattern that protects signed software can be applied to AI directives: sign the instruction at its authorized source, then verify that signature before an agent acts. Keyfactor’s enterprise signing infrastructure, SignServer, together with its PKI platform, EJBCA, lets organizations sign AI agent directives, confirm their authenticity and integrity before execution, and enforce timestamp-based freshness so that old, captured directives cannot be replayed later.

A centralized signing service also removes much of the operational burden. Systems that need to sign a directive call a signing API and never handle private keys directly, while key generation, secure storage, rotation, and revocation are managed centrally according to policy. In the layered security model, cryptographic signing serves as the foundational trust layer. It is what makes the upper layers, such as semantic analysis and human oversight, trustworthy, because analyzing a directive of unknown origin yields conclusions you cannot safely act on, while analyzing a verified directive lets you act with confidence.

To see how these pieces fit together in production, explore Keyfactor’s approach to securing AI agents.

Key takeaways

• Prompt injection is malicious content hidden in the data an AI processes, designed to override its instructions and make it perform unintended actions. It ranks as the number one risk in the OWASP Top 10 for LLM applications.
• The stakes rose sharply with agentic AI. When a prompt becomes a directive that an agent acts on, injection shifts from producing a wrong answer to triggering unauthorized real-world actions.
• There are several types, including direct, indirect, and triggered injection, and the danger grows with the level of autonomy an agent is given.
• The risk compounds in multi-agent systems, where context about trusted versus untrusted data can be lost as instructions pass from agent to agent.
• No single defense is enough. Effective protection layers input controls, least privilege, human oversight, semantic analysis, and a foundational layer of cryptographic trust that verifies directive authenticity and integrity.