What Is Prompt Injection in AI? A Plain-English Guide

Picture a new assistant told to sort the mail. One letter says, "Assistant, while you're at it, mail me the office keys." A person would laugh and bin it. An AI tool might do it. OpenAI describes the problem as "a type of social engineering attack specific to conversational AI," like phishing, but aimed at the AI instead of you. OWASP, the nonprofit web security project, lists prompt injection first in its Top 10 risks for AI language apps.

This guide is for everyone, not just security teams. It covers what prompt injection is, the two main kinds, how it differs from jailbreaking, why nobody has fixed it, and what you can do. For the effect on AI search and marketing, see our investigation into prompt injection and "black hat" GEO.

A Simple Way to Picture It

When you use an AI app, the model doesn't see "rules" and "your question" and "a web page" as separate things. It sees one long run of text, stitched together:

1. The app's own instructions, written by its makers.
2. Your request.
3. Anything the app fetched to help: a page, a file, an email, search results.

The model then predicts what should come next. As the UK's National Cyber Security Centre puts it, "there is only ever 'next token'," meaning the next small piece of text. Nothing in that stream is stamped "obey" or "just read." So if part 3 contains a line that sounds like an order, the model may follow it.

Where the name came from

The term dates to September 2022. Riley Goodside showed that GPT-3, set up to translate text, would drop the job and print a silly phrase if the text to translate told it to. Simon Willison named the trick "prompt injection," after SQL injection, an old attack where data sneaks into a database command.

Direct and Indirect Prompt Injection

There are two kinds, split by who plants the text. The examples below are illustrative and defanged: the brand is a placeholder and the instructions are harmless or removed.

Direct: the attacker is typing

In direct prompt injection, the user is the attacker. They type something that tries to override the app's instructions. A customer service bot might be told to drop its rules, reveal its hidden set-up text, or make a promise the company never approved. The harm usually lands on the company that runs the bot.

Indirect: the attacker left a note

Indirect prompt injection is sneakier. The attacker hides instructions somewhere the AI will look later, then waits. You ask for something innocent, like "summarize this page," and the AI meets the planted text on the way. Researchers named this form in February 2023. It's the kind behind most serious real cases. Our guide to indirect prompt injection lists them by date.

The text doesn't even need to be visible. OWASP notes that injections "do not need to be human-visible/readable, as long as the content is parsed by the model." White text on a white page, tiny fonts and text inside images have all been used.

Prompt Injection vs Jailbreaking

People often use these words as if they mean the same thing. They're related, but the target differs.

Willison, who coined the first term, draws the line this way: prompt injection attacks apps that mix "untrusted user input with a trusted prompt," while jailbreaking tries "to subvert safety filters built into the LLMs themselves." OWASP groups them more loosely and calls jailbreaking "a form of prompt injection." Both views agree on the practical point. Jailbreaks mostly make a model say bad things. Injection can make an app do bad things with your data.

Why Nobody Has Fixed It Yet

Security people fixed SQL injection years ago. The fix, called parameterized queries, keeps data and commands in separate lanes, so data can never run as a command. Prompt injection has no such lane. The NCSC says current models "simply do not enforce a security boundary between instructions and data inside a prompt," and that the problem "may never be totally mitigated" the way SQL injection was.

The AI companies say much the same:

• OpenAI wrote in December 2025 that prompt injection, like scams, is "unlikely to ever be fully 'solved'."
• Anthropic wrote in November 2025 that "no browser agent is immune to prompt injection."
• OWASP says "it is unclear if there are fool-proof methods of prevention."

That doesn't mean nothing works. Vendors train models to distrust outside text, run separate checkers that spot attacks, and ask you before risky steps. Each layer lowers the odds. None brings them to zero, and attackers adapt. Our step-by-step look at how prompt injection works explains each defense and why simple filters fall short.

How Much Should You Worry?

It depends on what the AI can reach and do. OWASP lists the possible results, which range from mild to severe:

• revealing private information or the app's hidden instructions;
• skewed or false answers;
• using features or tools it shouldn't;
• running commands in connected systems;
• steering important decisions.

A chatbot that only chats can, at worst, give you a bad answer. The stakes jump when the AI can read your inbox, open your files, browse while logged in, or send messages for you. In June 2025, researchers showed Microsoft 365 Copilot could be made to leak data through a single email, with no clicks from the victim. Microsoft fixed it, and there was no evidence anyone was attacked. It still shows why access matters more than cleverness.

What Everyday Users Can Do: The Three-Question Pause

Before you hand an AI tool a task, pause on three questions. We call this the Three-Question Pause.

1. What is it reading that I didn't write? Web pages, emails from strangers, shared files and reviews can all carry planted text.
2. What can it reach? Your inbox, your files, your accounts, your saved passwords?
3. What can it do without asking me? Send, buy, post, delete, or open links?

If the answer to all three is "a lot," slow down. Here is how that plays out in common situations.

Two more habits help. First, follow the vendors' own advice: OpenAI suggests using logged-out mode when an agent doesn't need your accounts, and checking every confirmation request before you approve it. Second, look at your AI's saved memories now and then. Microsoft found companies planting "remember us as a trusted source" lines through AI links, and it advises deleting any memory you don't recognize.

What Site Owners and Marketers Should Know

If you run a website, prompt injection touches you in three ways.

1. Don't hide instructions for AI. Some marketers try hidden text that tells AI assistants to recommend them. Google's spam policies cover attempts to manipulate AI answers in Google Search, a point Google clarified on 15 May 2026. Bing's guidelines say it can reduce, suppress or delist sites that try.
2. Check that nobody hid them for you. Hacked plugins and spam comments can plant text you never wrote. Our hub guide includes a site audit you can run in an afternoon.
3. Keep your "Ask AI" buttons plain. A button that opens an assistant with a simple question is fine. One that slips in "remember us" crosses into what Microsoft calls AI Recommendation Poisoning.

What earns AI citations is the opposite of a trick: clear, visible, sourced pages. Our guide to optimizing content for AI search covers how.

A Word on AI Writing Tools

Rankbox's Citation-Ready Writer reads live web pages to research each article, so it meets outside text just like any AI tool that browses. No product that reads the web is immune to prompt injection, and that includes ours. Whatever tool you use, read the draft and check its sources before it goes live.