What is prompt injection?
Prompt injection is when you slip instructions into a prompt that change what the model does. Think of it like SQL injection but for LLMs. The model can't tell your input apart from its own instructions, so it follows whatever you tell it.
There are two flavors:
- Direct injection: you put the instructions in your own prompt. The model reads them and follows them.
- Indirect injection: you hide instructions in data the model reads (a web page, a document, an email). The model processes that data and follows the hidden instructions without knowing they came from an untrusted source.
Why it works
LLMs process everything as text. There is no security boundary between "user input" and "system instructions" at the model level. The system prompt, the conversation history, and your query all go into the same context window. The model just predicts the next token based on all of it.
This means if you write something that looks like a system instruction, the model treats it like one. If you write something that looks like a previous assistant response, the model treats it like its own prior behavior.
Context boundary attacks
The most basic prompt injection attacks the context boundary. You tell the model the previous instructions ended and new ones started:
This is the basis of the GODMODE technique. The model sees the boundary markers and treats everything after them as a fresh context without the original safety instructions.
Key takeaway: The model has no real concept of "who said what." It just sees a sequence of tokens. If you structure your tokens to look like system instructions, the model follows them.
Real-world impact
Prompt injection matters because LLMs are increasingly used as agents that take actions: browsing the web, calling APIs, writing code, executing commands. If an attacker can inject instructions into data the agent reads, they can make the agent do things the developer never intended.
For example: an AI assistant that reads emails could be tricked into forwarding sensitive data if an attacker sends a carefully crafted email with hidden instructions. The model reads the email, follows the hidden instructions, and exfiltrates data.
Next steps
This covers the basics. If you want the actual techniques that work against current models in 2026, check out the AI Jailbreak Guide. It has tested system prompts, encoding techniques, and real test data showing what works against Claude, GPT-5.2, Gemini, and 50+ other models.
Disclaimer: This is educational content about AI security. Understanding prompt injection is essential for anyone building with LLMs. How you use this knowledge is your responsibility.