What is prompt injection?
Prompt injection is hidden or malicious instructions in a document, email or web page that try to make an AI system do something its owner did not intend. Direct injection is typed in by a user. Indirect injection hides instructions in content the AI reads, such as a PDF or web page. OWASP ranks it first among 2025 LLM application risks. Simon Willison proposed the name in September 2022.
Why it matters to a revenue leader
Phishing tricks people; prompt injection tricks software that acts for people. The risk grows as AI agents read inbound email, bid packages and web pages and can also send messages or update records. A request for proposal could carry hidden text telling an AI to reveal pricing or forward files. OWASP's guidance includes limiting what the AI can access and requiring human approval for high-risk actions, which makes this a question of permissions as much as technology.
Example
A fire protection company with 10 sellers uses an AI assistant to summarize inbound bid packages. One package includes white-on-white text telling the AI to email the company's price list to an outside address. The assistant can draft summaries but has no permission to send email, so the instruction goes nowhere, and a reviewer later finds the hidden text.
"What could our AI tools do on their own after reading a document written by someone who wants to mislead them?"
Sources
- LLM01:2025 Prompt Injection - OWASP Gen AI Security Project checked 9 Oct 2026
- Prompt injection attacks against GPT-3 checked 9 Oct 2026