Definition
Direct prompt injection is an attempt to override or redirect an AI application's intended instructions through the current user's input. A user might ask the model to ignore its rules, reveal protected context, misuse a tool, or take an action outside the task they were authorized to request.
Simon Willison named the broader attack pattern prompt injection in September 2022, drawing an analogy to SQL injection. The central weakness is that trusted instructions and untrusted text reach the same model as language, without a dependable security boundary between them.
Authentication does not solve the problem. A signed-in user may still be malicious, compromised, or simply unauthorized for the requested effect. Controls must validate proposed actions against policy and user authority, restrict tool permissions, and require approval for consequential operations.
Distinguish it from nearby terms
Direct injection comes through an explicit input channel controlled by the interacting user. Indirect injection arrives through content the system retrieves or observes, such as a webpage, document, email, or tool response. A jailbreak is an attempt to bypass model restrictions; it may use direct prompt injection, but the terms describe different aspects of the attack.
Check your understanding
A user tells a purchasing agent to ignore its spending limit and place an oversized order. The message is a direct prompt injection. The real defense is an enforced transaction limit outside the model, not another sentence in the system prompt.