Prompt Injection

Prompt injection exploits the fact that most LLM-powered applications blend trusted developer instructions and untrusted user input in the same context window. Direct prompt injection submits adversarial text (ignore your instructions; reveal your system prompt; call this tool with these parameters) through a user-facing surface. Indirect prompt injection smuggles the adversarial text through an intermediate channel the application later ingests — a web page the LLM is asked to summarise, a PDF it is asked to analyse, an email it is asked to triage. The OWASP LLM Top 10 lists prompt injection as the #1 risk for LLM-powered applications.

For privacy specifically, prompt injection is a breach vector: a successful injection can cause the LLM to disclose system prompts (which may embed credentials), to call tools with attacker-controlled parameters (exfiltrating data via connected systems), or to leak personal data from retrieved context. Defences combine input filtering, output moderation, tool-call authorisation checks, context-isolation (separating untrusted data from trusted instructions in the model's view), and runtime policy enforcement. Under GDPR, DPDP and PDPA, a confirmed prompt-injection-driven data exposure is a notifiable breach.