Prompt Injection

What it is

Prompt injection is instructions inside an AI system's input, written to change what the system does rather than to inform it. They may be typed in directly, or hidden in content the system reads; OWASP notes the input need not be human-readable, need not come directly from a user, and need not be visible in the rendered interface. It is the first entry, LLM01, in the current OWASP GenAI LLM Top 10, published in August 2026 and maintained by the OWASP GenAI Security Project. The indirect form is the one that matters for published content: the instruction is planted in a web page, document or review that the system retrieves in the ordinary course of answering.

Why it matters

Any system that retrieves untrusted text can be steered by text inside it, and OWASP puts the defence in the architecture rather than in interception: it states that no reliable prevention mechanism exists today and that no single control is sufficient. Semantic filters are evadable by rephrasing or encoding, and OWASP expects the controls that reduce injection success to degrade against adaptive attackers — attackers who have read the deployed defence — so the boundary cannot rest on them. Treat retrieved content as data, never as instructions, and keep that boundary explicit in the system design. For a claim registry the specific exposure is that a third-party page could attempt to alter what an assistant reports about you. Knowledge Company treats every retrieved page as data, including the ones describing its own customers.