AI features: prompt injection and what the model can do

When a team adds a large language model to a product, they add a component that follows instructions written in plain language. The problem is that it cannot reliably tell your instructions apart from instructions hidden in the text it reads: a user message, a web page, an email, a document or a tool result. That is prompt injection, and the OWASP Top 10 for LLM Applications 2025 lists it first, as LLM01.

Direct and indirect

• Direct: a user types instructions meant to override the system prompt.
• Indirect: the model reads content that someone else wrote, such as a support ticket or a web page, and that content carries the instructions.

Indirect injection is usually the bigger risk, because the person harmed is not the person who wrote the attack.

Limit the blast radius

1. List what the feature can read. Does it see data the current user should not?
2. List what it can do. Send email, call APIs, change records, run code?
3. Give it only the permissions of the user it is acting for, never a shared admin key.
4. Require a human to confirm actions that are hard to undo, like payments or deletions.
5. Treat its output as untrusted input. Escape it before showing it, and validate it before acting on it.

Several items on the OWASP LLM list follow from this: Sensitive Information Disclosure (LLM02), Improper Output Handling (LLM05), Excessive Agency (LLM06) and System Prompt Leakage (LLM07). If you design for injection, you cover a large part of the list.

Questions to ask the AI team

• What is in the system prompt, and would it matter if a user saw it?
• Which outside content can reach the model?
• What tools can it call, and with whose permissions?
• Is there a limit on usage per user, so one person cannot run up the bill?

Rule of thumb:Never put secrets, keys or internal rules you need to stay private in a system prompt. Assume a determined user will read it.