Prompt injection attacks exploit AI’s blind spots to hijack systems and leak data

Prompt injection attacks manipulate large language models (LLMs) by slipping malicious instructions into their input, overriding safety controls and forcing unintended behavior. These attacks exploit a fundamental flaw: LLMs treat all input—user prompts, system instructions, and external data—as one continuous directive, with no inherent separation between trusted and untrusted sources. The result can range from data leaks and social engineering to full system hijacking, where an LLM executes unauthorized actions or controls other systems.

The threat extends beyond text. Researchers at Xidian University demonstrated CrossMPI, an image-based attack that embeds nearly imperceptible pixel-level perturbations into images to alter how vision-language models (VLMs) process visual and textual inputs. By targeting screenshots, web pages, or data visualizations, attackers bypass text-only safety layers, creating a new attack surface for AI agents that read or interpret images. Cisco Systems’ analysis of typographic prompt injection shows how embedded instructions in pixels can manipulate VLMs into ignoring prior directives or revealing sensitive information.

Real-world examples highlight the stakes. In one case, attackers hijacked a custom GPT-based shopping assistant to always recommend a single brand, overriding user preferences with a hidden system instruction. Another attack injected fake growth claims about a nonexistent company into financial forums, tricking an LLM-powered stock analysis tool into labeling the firm as an industry leader. These scenarios underscore how prompt injection can distort decisions, manipulate perceptions, and even influence markets.

How prompt injection works

Direct prompt injection involves feeding malicious text directly into an LLM, such as crafting a request that appears legitimate but contains hidden commands like ‘ignore all previous instructions.’ Indirect attacks, however, are more insidious: they exploit external data sources—APIs, documents, or web pages—to smuggle instructions into the model’s context. For instance, an attacker might embed a directive in a PDF’s metadata field or publish misleading claims on fringe sites, ensuring the LLM processes the malicious input as part of its normal workflow.

The lack of input isolation is the core vulnerability. Unlike traditional software, LLMs don’t distinguish between trusted system prompts and user-provided data. This design choice, while enabling flexibility, creates a gap that attackers exploit to override safety filters, bypass guardrails, or trigger unintended outputs. Even advanced models like OpenAI’s GPT-5.6, tested with the GPT-Red framework, showed a 0.05% failure rate for direct attacks but higher success for indirect methods—3.77% for the Sol model, 3.32% for Terra, and 2.94% for Luna—demonstrating that no amount of hardening can eliminate the risk entirely.

The risks to users and systems

For consumers, the danger lies in chatbots or AI tools that access external sources—such as scanning emails or pulling search results—to generate responses. If an attacker controls or manipulates these sources, they can inject prompts that trick the AI into revealing personal data, generating fraudulent content, or even directing users to malicious links.

Apostol Vassilev, a cybersecurity researcher at the National Institute of Standards and Technology (NIST), warns that connecting LLMs to infrastructure—such as databases, APIs, or other systems—amplifies the risk. Apostol Vassilev of NIST stated that “Large language models are inherently vulnerable to prompt injection attacks, and no amount of hardening will ever fully close that gap.” He emphasized that agentic AI, which autonomously interacts with external systems, demands superior infrastructure security compared to model-level defenses. The OWASP AI Vulnerability Scoring System provides a framework for organizations to measure and mitigate residual risks, but the fundamental challenge remains: LLMs were not designed with robust input isolation in mind.

Mitigation strategies

Defending against prompt injection requires a layered approach. Input validation is the first line of defense: sanitizing all user-provided data, filtering for suspicious patterns (e.g., commands to ignore prior instructions), and scrutinizing content from APIs, documents, or web pages. Prompt engineering can reinforce boundaries by using strict templates to separate system instructions from user input, such as role-specific tokens or delimiters, and minimizing free-form input in system prompts. Isolation and sandboxing further limit damage by restricting LLMs’ access to sensitive systems or data, routing actions like API calls through controlled execution layers.

Monitoring and detection are critical for spotting anomalies in LLM interactions, such as sudden tone shifts, unexpected disclosures, or command-like responses. Rule-based classifiers or machine learning models can identify malicious patterns, while human oversight—requiring manual review for critical actions like financial approvals or legal document generation—adds an extra layer of safety. OpenAI’s Lockdown Mode, introduced in Jun. 2026, exemplifies this strategy by disabling live web browsing, image retrieval, and agent capabilities to reduce exposure to indirect attacks. However, even such measures acknowledge a harsh reality: prompt injection is a persistent threat, not a solvable problem.

What users can do

Individuals interacting with AI tools should adopt cautious habits. Limit the control AI has over external content – such as restricting chatbots from accessing personal emails or search results – while avoiding sharing sensitive data with untrusted systems. Verify links by opening them in a new window, and stay alert for suspicious AI behavior, such as sudden shifts in tone or unexpected requests for personal information. Keeping LLMs updated and staying informed about emerging threats can also reduce exposure.

For businesses, the priority is integrating security controls at every stage of AI deployment, from input validation to human oversight, and treating prompt injection as an ongoing risk rather than a one-time fix.