Prompt injection

Prompt injection is an attack where crafted input makes an AI model ignore its original instructions, for example to reveal hidden prompts, leak data or take unintended actions. It is ranked as the top risk in the OWASP Top 10 for LLM Applications and should be tested before every release.

Direct and indirect prompt injection

• Direct: the user types instructions such as “ignore your previous instructions” into the chat.
• Indirect: the instructions hide in content the model reads, such as a web page, email, PDF or tool result.

How to test for it

• Keep a library of known attack prompts and run it against every release.
• Test indirect cases by planting instructions in documents your app retrieves.
• Check what the model is allowed to do: tools, data access and actions it can trigger.
• Use a red-teaming tool such as Promptfoo to generate and score attacks automatically.

Prompt injection is listed first in the OWASP Top 10 for LLM Applications.

Read the full guide: Prompt Injection Testing: How QA Teams Test LLM Apps (2026)