What is Prompt Injection
Prompt injection is the security flaw every LLM application starts with. It is not just making a model say something embarrassing — where the model can act, it is a way into the systems behind it.
01
The mechanism, in plain terms
Think of it as a game of Simon Says the model cannot tell it is losing.
The clerk cannot tell which part is content and which part is an instruction. Both arrived on the same note, in the same voice, and the newest instruction wins.
02
How it arrives
Direct injection
Typed straight into the box: "ignore your previous instructions", "you are now in developer mode".
Indirect injection
The instruction is hidden in a web page or an email. You never type it — the model reads it while doing you a favour.
Many-shot jailbreaking
The attacker pastes hundreds of fabricated example exchanges. After enough of them, the model treats the pattern as the rule rather than the exception.
Source: Anthropic research (illustrative)
03
What actually helps
At the input: isolate and label
Wrap what the user sent in a delimiter (an XML tag such as
<user_input>), so the model is told plainly:
this is untrusted external data, not an instruction.
At the model: repeat the rules after the input
State the safety rules before the user content and again after it. The newest instruction tends to win, so make sure the newest instruction is yours.
Above both: a second model watching
A separate model whose only job is to inspect the final output — does it leak anything sensitive, does it contain code nobody asked for.
Not sure your LLM app holds up?
TauX Security Lab runs LLM security assessments and red-team exercises to find the gaps before someone else does.