LLM prompt injection

When it applies

The app sends model input that mixes trusted instructions (system prompt) with untrusted data (user text, a fetched web page, a file, RAG chunks). Impact scales with what the model can do: answer only < read private context < call tools/APIs < take actions.

Why it works

LLMs don't separate "instructions" from "data" — it's all tokens. Attacker text in the data channel can override the system prompt. Indirect injection hides instructions in content the model will later read (a page it summarizes, a document, an email), so the victim triggers it.