YTYK You think you know

Card 13 of 18 Guardrails ●○○ Foundational

Prompt injection is the unsolved one

Prompt injection is OWASP's number one entry for LLM applications: user or retrieved content alters the model's behaviour in unintended ways. It is unsolved because the model receives instructions and data in the same channel, with nothing marking which is which.

Why it is like this

Classic injection attacks were fixed by separating code from data — parameterised queries, escaping. A language model has no parameterised equivalent: the instruction and the document are both just text.

Not to be confused with

A filtering problem. Filters raise the cost of an attack and do not close the class. And the dangerous version is usually indirect: the instruction arrives inside a document, a web page or an email the system was asked to read, not from the user.

In practice

This is why an agent that reads untrusted content and holds real permissions is a different risk from a chatbot that does neither.

Source: OWASP Top 10 for Large Language Model Applications, 2025 — LLM01:2025 Prompt Injection. Read on .

The OWASP Top 10 for LLM Applications is © the OWASP Foundation and published under a Creative Commons licence; NIST AI 600-1 is a US Government work in the public domain. These cards are independent commentary written in our own words. ytyk.org is not affiliated with or endorsed by the OWASP Foundation or NIST.

Predict Check yourself

Why is prompt injection not fixable the way SQL injection was?

  1. SQL injection was fixed by separating code from data in the protocol; a model receives instructions and data in one channel with no way to mark the boundary.
  2. Because models are closed source and cannot be patched.
  3. Because it only affects systems that use retrieval.
  4. It is fixable — output filtering closes the class.
Show the answer

SQL injection was fixed by separating code from data in the protocol; a model receives instructions and data in one channel with no way to mark the boundary.

Knowing it is a structural property rather than a missing patch changes the design: you contain the blast radius instead of trying to sanitise the input.