What Is Prompt Injection?
How Prompt Injection Works
Prompt injection is an attack in which crafted text makes a language model ignore its original instructions and follow the attacker's instead. The model receives instructions from the developer, such as answer questions about our products only, and data from users or documents. If it cannot reliably separate the two, a hostile input can change its behavior.
The attack works because language models process all text in much the same way. There is no hard boundary between a system instruction and a user message, so a carefully worded request can override the rules the site owner intended. The name echoes SQL injection, a classic web attack, but the target is the model's instructions rather than a database query.
Direct and Indirect Attacks
Direct prompt injection happens when the attacker types the malicious instruction into the chat. A visitor might try to make a support bot reveal its hidden instructions or discuss topics it should refuse.
Indirect prompt injection hides the instruction in content the model reads later: a web page it summarizes, an email it processes, a document uploaded to a knowledge base, or a comment on a page. The user never types the attack, which makes it harder to spot.
Risks for Websites and Hosting Accounts
The risk grows when a model can take actions, not only answer questions. A chatbot that can read customer records may leak them. An AI agent connected to a hosting account or a content management system may be tricked into changing files, sending emails or exposing credentials if its permissions are too broad. The principle of least privilege matters here: give the model access only to what it needs, and require confirmation for sensitive actions.
Prompt injection cannot be solved by filtering a few phrases, because attackers can rephrase, encode or hide instructions in many ways. Defense relies on layers: limited permissions, separation of untrusted content, monitoring of outputs and a human in the loop for high-impact steps.
For the chatbot context, see how AI chatbots for websites work. For agents that take actions with tools, see what AI agents are.
Frequently asked questions
Is prompt injection the same as hacking a website?
Not exactly. Hacking usually means gaining unauthorized access to systems. Prompt injection manipulates how an AI model behaves, which can lead to unauthorized actions if the model has access to tools or data. Standard web security, such as patching and access control, still applies.
Can a website owner protect a chatbot from prompt injection?
Only partly. Restrict what the chatbot can see and do, keep secrets out of prompts, check outputs and require human approval for actions that change data or send messages. No single control is enough, and the risk should be reviewed whenever the bot gains new capabilities.