What is prompt injection? Prompt injection is a situation where input changes the behavior or output of a language model in ways the developer did not intend, including when that input is not visible to humans but the model still reads it. According to OWASP GenAI's LLM01 page (accessed 25/10/2026), this technique includes direct and indirect forms, and there is no way to prevent it completely, only to reduce its impact. This post explains what prompt injection is, its consequences, seven risk reduction measures, when it is especially dangerous, and OPCAIOS's experience.
Treat all content an agent reads as data, not commands. Diagram: OPCAIOS.
What is prompt injection and how many forms does it have?
There are two forms. Direct: user input changes model behavior, intentionally (an attacker) or unintentionally. Indirect: the model reads outside content like websites or files containing hidden instructions, and those instructions steer behavior.
The indirect form is dangerous for AI agents because agents read many sources the owner does not control. The OWASP page also mentions jailbreak as a related form aimed at completely bypassing safety rules, and warns that multimodal models increase risk because instructions can hide in images or scatter across multiple forms.
Possible consequences
According to OWASP, consequences include leaking sensitive data or system prompts, wrong or biased output, unauthorized access to functions the model is connected to, executing commands in the attached system, and damaging important decisions.
The degree depends on the permissions you grant the model. A chatbot that only outputs harmful text causes limited harm; an agent that reads email and has permission to send messages, write to databases, or run commands can cause real harm. This is why the principle of least privilege matters.
Seven risk reduction measures
OWASP lists measures that help reduce impact, and emphasizes that none blocks it completely. Combine multiple layers instead of relying on one.
- Define role and limits in the system prompt, requiring attempts to override to be rejected.
- Set output format rules and check output with code (not by feel).
- Filter input and output for sensitive content, and assess relevance and source grounding.
- Least privilege: the application keeps tokens and functions in its code, does not hand them to the model.
- A person approves high-risk actions.
- Separate and label untrustworthy outside content.
- Run adversarial tests periodically, treating the model as an untrusted user.
When is prompt injection especially dangerous?
When the model both reads untrustworthy content and has permission to act. Three factors at once—private data, uncontrolled outside content, and ability to send data out—are a high-risk mix. This is OPCAIOS's practical judgment, not quoted from OWASP.
| Situation | Risk | Suggestion |
|---|---|---|
| Chatbot answers only, no tools | Low to medium | Filter output, limit role |
| Agent reads web and email | High | Treat content as data, approve before acting |
| Agent can write real data | Very high | Least privilege, human reviewer, logs |
| Summarize internal documents | Medium | Separate and label content, check grounding |
See also data security when using AI and tool use.
OPCAIOS's experience
Our working rule with agents: all content read from web, email, or files is data, not commands; if that content asks for an action, we ask the user again first. Actions that cannot be undone like posting or deleting data need clear human approval, and drafts the AI writes do not self-publish.
A real limit: we have not run formal adversarial tests against prompt injection across our whole system, so we cannot claim it is immune. We see these rules as a mitigation layer, exactly as OWASP warns that there is no way to eliminate it completely.
Frequently Asked Questions
Is prompt injection similar to SQL injection?
The idea is similar: data is interpreted as a command. But since language models don't have a complete separation method, OWASP says we can only reduce the impact.
Can RAG or fine-tuning prevent prompt injection?
According to OWASP, RAG and fine-tuning cannot completely prevent it; see RAG and fine-tuning.
How do I know if my agent has been injected with commands?
Signs: actions outside the request, strange output after reading an external source, requests to send data outside. Logging and step review help detect it.
Should I block my agent from reading the web?
Not necessarily; reduce permissions after reading: don't allow sending data outside or writing real data without review.
Where should I start?
List your agent's permissions, remove unnecessary ones and add a review step for actions that can't be undone. You may need design consultation; see AI application training service.
Source: OWASP GenAI Security Project, "LLM01: Prompt Injection" (genai.owasp.org), accessed 25/10/2026. Risk table by scenario and "three factors" assessment are from OPCAIOS, not quotations. Experience is from OPCAIOS.
Translated from Vietnamese with AI. Read the original.
Want to apply this in your business?
Book a free 30-minute call (Vietnam time, in English or Vietnamese).