Glossary · AI and automation
What is prompt injection?
Prompt injection is an attack in which text supplied to an AI system, typed by a user or hidden in content it reads, tries to override the system's instructions, for example to reveal confidential information or take unintended actions. OWASP lists it as the top risk for applications built on large language models.
Also called: LLM prompt injection, jailbreak
Prompt injection, explained
Language models follow instructions written in text, and they cannot reliably tell the business's instructions apart from instructions in the conversation. Prompt injection exploits that. A direct injection is typed by the user: “Ignore your previous instructions and…”. An indirect injection is hidden in content the model reads, such as a web page, document or product review.
The OWASP Top 10 for LLM Applications 2025 ranks prompt injection first (LLM01) and describes both direct and indirect forms.
For support chatbots, the realistic risks are revealing internal instructions or data, being tricked into making promises such as discounts or refunds, and misusing any connected actions. The more a bot can do, the more an injection can do.
No filter stops every injection, so the main defence is limiting impact: give the bot least-privilege, preferably read-only access; verify identity before returning personal data; keep commitments like refunds with humans; never place secrets in the prompt; and log conversations so abuse can be reviewed.
Common mistake
How SuperBot relates
SuperBot reads store products, stock and orders read-only, verifies order lookups against the customer's email, and never writes to the store, which limits what a manipulated conversation could reach.
Frequently asked questions
What is the difference between direct and indirect prompt injection?
Direct injection is typed into the conversation by the user. Indirect injection is hidden in content the AI reads, such as a web page or document, and takes effect when the model processes it.
Can prompt injection be fully prevented?
Not reliably with current models. Reduce the impact instead: least-privilege and read-only access, identity checks before personal data, human approval for commitments, and conversation logging.
Sources
Test it on your own questions.
SuperBot trains on your content, answers with citations and hands off to your team. The free plan includes 200 conversations a month, no card required.