Block the #1 LLM attack vector
Runtime detection and prevention of direct and indirect prompt injection attacks — the OWASP LLM01 vulnerability that lets attackers override your system prompt and hijack AI behaviour.
What is Prompt Injection Protection — Block AI Manipulation Attacks?
Prompt injection is an attack technique in which malicious instructions are embedded in user input or retrieved context to override or manipulate an LLM's system prompt. Direct injection embeds attack instructions directly in user messages; indirect injection plants them in external content the LLM retrieves — documents, web pages, or database records. Prompt injection is OWASP LLM01, the top-ranked risk for LLM applications.
Why prompt injection is so difficult to prevent
- LLMs cannot reliably distinguish between instructions from system prompts and instructions embedded in user input or retrieved data
- Indirect prompt injection is invisible to the user — attack payloads hide in documents, emails, and web pages the LLM reads
- Jailbreak techniques evolve continuously — blocklist-based defences are bypassed within days of publication
- Agentic systems with tool access make prompt injection critical: a hijacked agent can call APIs, exfiltrate data, or take destructive actions
A four-step operational model
Input Classification
Classify every input to the LLM context for injection payloads, instruction-format patterns, and known jailbreak signatures.
- Injection payload detection
- Instruction-format classification
- Known jailbreak signature matching
Context Sanitisation
Strip or quarantine injected instructions from retrieved external content before it enters the LLM context window.
- Document injection stripping
- RAG context sanitisation
- Email and URL content filtering
Response Monitoring
Analyse LLM outputs for signs of successful injection — unexpected instruction-following, data disclosure, or system prompt leakage.
- System prompt leak detection
- Anomalous behaviour flagging
- Output confidence scoring
Adversarial Test Suite
Automated red-team test suite continuously tests your LLM endpoints against 100+ prompt injection and jailbreak scenarios.
- 100+ injection test cases
- Jailbreak resistance scoring
- Regression tests on each model update
Outcomes for security teams
Prompt injection is OWASP LLM01
It is the most critical and most exploited vulnerability class for LLM applications — responsible for data exfiltration, safety bypass, and agent hijacking incidents.
Indirect injection is nearly invisible
Attackers plant injection payloads in content your LLM reads — emails, documents, and web pages — without any direct access to your application.
Agents amplify the impact dramatically
When an LLM has tool access, a successful prompt injection attack becomes a full agent hijacking with potential for data exfiltration and system compromise.
Direct answers
What is prompt injection?+
Prompt injection is an attack where malicious instructions embedded in user input or retrieved content override an LLM's system prompt — allowing attackers to manipulate AI behaviour, extract data, or bypass safety controls.
What is indirect prompt injection?+
Indirect prompt injection plants attack instructions in external content the LLM reads — such as documents, web pages, emails, or database records — rather than in direct user input. The user does not need to be malicious.
Can prompt injection be fully prevented?+
No single defence is complete, but layered controls — input classification, context sanitisation, output monitoring, and minimal-privilege tool permissions — dramatically reduce the attack surface and impact of successful injection.
Does Threatstealth test for indirect injection?+
Yes. The adversarial test suite covers both direct injection (user input) and indirect injection (retrieved content), including RAG pipeline attack scenarios.