What Is Prompt Injection? A Plain Guide for AI Users at Work

AI assistants are increasingly asked to read things for you: summarize a web page, sort your inbox, review a job application, answer questions from a shared folder. That convenience creates a new kind of security problem. If the AI reads text that contains instructions, it may follow them, even when those instructions came from a stranger rather than from you. This is called prompt injection, and it sits at the top of the main industry list of AI application risks.

1. What it is

The OWASP Gen AI Security Project, part of the nonprofit Open Worldwide Application Security Project, publishes a widely used Top 10 list of risks for applications built on large language models. Prompt injection is number one, listed as LLM01:2025. OWASP defines it as a vulnerability where prompts alter the model's behavior or output in unintended ways.

One detail is especially important: OWASP notes that injected instructions do not need to be visible or readable to people. As long as the model processes the content, hidden text can affect it.

NIST's Generative AI Profile describes the same risk from the government side: prompt injection involves changing what input reaches an AI system so that it behaves in unintended ways.

2. Direct and indirect injection

Both OWASP and NIST describe two forms.

Direct injection is when someone types instructions straight into the AI to make it misbehave, such as telling a customer support chatbot to ignore its rules. OWASP notes this can even be unintentional, when an ordinary user's input happens to trigger unexpected behavior.

Indirect injection is the one that affects ordinary office workers most. OWASP describes it as instructions arriving through external content the AI reads, such as websites or files. NIST explains that attackers can do this remotely, without any direct access to the AI, by planting instructions in data that the AI is likely to retrieve. NIST adds that security researchers have already shown indirect injection being used to steal proprietary data and to run malicious code remotely.

In other words, you do not have to do anything wrong. You only have to ask your AI tool to read something that someone else has booby-trapped.

3. What it looks like in practice

OWASP's list includes example scenarios that map closely onto everyday work:

• A web page summary. A user asks an AI to summarize a web page that contains hidden instructions. The instructions make the AI insert an image link to an outside address, which leaks the private conversation.
• A resume review. An applicant uploads a resume with malicious instructions split into pieces. When an AI evaluates the candidate, the combined instructions push it toward a positive recommendation regardless of the actual qualifications.
• A shared knowledge base. Someone edits a document in a repository the AI draws answers from. When a user's question pulls in that document, the planted instructions produce misleading answers.
• An email assistant. OWASP cites a real vulnerability in an AI-powered email assistant that let attackers inject prompts to reach sensitive information and manipulate email content.
• An image. Instructions can be hidden inside an image that accompanies harmless text, affecting AI tools that read both.

OWASP lists the possible consequences, including disclosure of sensitive information, manipulated or biased output, unauthorized use of the tools the AI can access, and influence over important decisions.

4. Why it is hard to fix

OWASP is candid about this: because of how generative AI works, it is unclear whether there are fool-proof ways to prevent prompt injection. Its guidance focuses on limiting the damage. Two of its recommended measures matter most for regular users:

• Least privilege. Give the AI only the access it needs for the task.
• Human approval for high-risk actions. Keep a person in the loop before anything privileged happens.

OWASP also recommends separating and clearly marking untrusted content, and treating the model itself like an untrusted user when testing what it can reach.

5. Habits that reduce your risk

You cannot patch the model, but you can control how you use it. These habits follow directly from OWASP's guidance:

1. Be careful what you connect. Every mailbox, drive or app you link to an AI assistant is something an injected instruction could try to use. Connect only what the task needs.
2. Keep approval steps on. If your tool asks before sending email, sharing files or making purchases, leave that setting enabled and actually read the request.
3. Treat outside content as untrusted. Web pages, emails from unknown senders, uploaded resumes and vendor files can carry instructions you cannot see.
4. Watch for strange behavior. If a summary suddenly includes an unexpected link, a request for information, or an action you did not ask for, stop and do not click.
5. Double-check AI judgments about people and money. Hiring screens, invoice approvals and similar decisions are exactly where OWASP's examples show manipulation paying off for an attacker.
6. Report it. If you see signs of manipulation in a workplace tool, tell your IT or security team.

6. Key takeaways

• Prompt injection is when instructions hidden in content alter an AI's behavior; OWASP ranks it as the top risk for LLM applications.
• Indirect injection arrives through web pages, files, emails and images the AI reads, and the text can be invisible to people.
• NIST notes researchers have shown indirect injection stealing data and running malicious code.
• OWASP says there may be no fool-proof prevention, so limiting access and requiring human approval matter most.
• Connect only what you need, keep confirmations on, and treat outside content as untrusted.