Artificial Intelligence is becoming part of everyday business operations, from chatbots and copilots to automated support, development assistants, and knowledge-search tools. But as adoption grows, attackers are also finding new ways to abuse AI systems. One of the most important risks is prompt injection, which OWASP lists as the top LLM application security risk for 2025. [genai.owasp.org]
Prompt injection happens when an attacker uses carefully crafted text to manipulate how an AI model behaves. Instead of attacking traditional code, the attacker attacks the model’s instructions. The goal may be to bypass rules, expose sensitive information, influence decisions, or trigger actions the AI was never meant to perform. OWASP explains that prompt injection can alter an LLM’s behaviour or output in unintended ways, including through text that may not be obvious to users.
There are two common forms. Direct prompt injection occurs when a malicious user enters instructions directly into an AI chat or application. Indirect prompt injection is more dangerous because the malicious instruction is hidden inside external content, such as an email, webpage, document, support ticket, or file that the AI later reads. OWASP describes indirect injection as occurring when LLMs process external sources that contain instructions capable of changing the model’s behaviour.
Attackers may also use role confusion, context manipulation, hidden instructions, or malicious content embedded in retrieved documents. In enterprise environments, this becomes especially risky when AI tools have access to emails, files, internal systems, plugins, or automation workflows. The more authority an AI assistant has, the greater the potential impact if it is manipulated.
Securing AI models requires more than a strong system prompt. Organizations should apply least privilege, ensuring AI tools only access the data and actions they truly need. Sensitive credentials, API keys, tokens, and system prompts should never be exposed to the model unnecessarily. Input filtering, output validation, data-loss prevention, and monitoring should be used to detect suspicious behaviour.
AI applications should also separate trusted instructions from untrusted content wherever possible. Retrieved documents, emails, and webpages should be treated as data, not commands. Security teams should conduct regular red-team testing, review AI logs, and test for both direct and indirect prompt injection scenarios.
Prompt injection cannot be solved by one control alone. It requires layered defence: secure design, access control, monitoring, user awareness, and continuous testing. AI can deliver huge value, but only when trust, identity, and data protection are built in from the start.
Security is not optional in AI — it is the foundation for safe innovation.
Cloud and Security 