"There is no such thing as a 100% secure system." - Roman Yampolskiy
At first glance, prompt injection looks similar to traditional injection attacks like SQL injection.
In both cases, untrusted input influences system behavior in unintended ways.
But the underlying security problem is very different.
Traditional injection attacks usually exploit parser confusion.
For example, in SQL injection, the database cannot correctly distinguish between:
- executable query logic
- user-provided data
That is why techniques like parameterized queries became so effective. They introduced strict structural separation between instructions and input.
The database engine knows exactly what is code and what is data.
Prompt injection is harder because LLMs do not operate like deterministic parsers.
They operate through probabilistic reasoning.
A language model does not truly "execute commands" in the traditional sense. Instead, it continuously interprets context and predicts what should happen next based on patterns learned during training.
That creates a fundamentally different security challenge.
SQL injection exploits parser ambiguity.
Prompt injection exploits reasoning ambiguity.
And unlike traditional parsers, LLMs do not naturally enforce hard boundaries between:
- trusted instructions
- external information
- contextual references
- behavioral influence
Everything participates in the same reasoning process.
That is exactly why many security techniques that work well in traditional systems do not map cleanly into AI systems.
You cannot simply sanitize language the same way you sanitize SQL queries.
Because language itself is flexible, contextual, and infinitely expressive.
And that is what makes prompt injection such an unusual security problem compared to traditional software vulnerabilities.
The Different Faces of Prompt Injection
One of the reasons prompt injection is so difficult to reason about is that it rarely looks the same twice.
The attack evolves based on how the AI system is designed, what capabilities it has, and how much external influence it accepts.
The simplest form is direct prompt injection.
This is the classic:
"Ignore previous instructions."
The attacker directly tries to override the model's intended behavior through user input. Most public jailbreak screenshots and viral demos fall into this category, which is why many people still think prompt injection is just a chatbot problem.
But modern AI systems introduced a far more dangerous category: indirect prompt injection.
Here, the malicious instruction does not come directly from the user. Instead, it is hidden inside content the system later processes as part of normal operation.
For example, researchers demonstrated attacks where hidden instructions embedded inside webpages could manipulate AI browsing agents into leaking sensitive data or changing behavior without the user ever seeing the malicious text.
That shift is important.
The attack no longer needs direct access to the conversation itself. It can travel through the data flowing into the system.
This is where techniques like RAG poisoning start becoming dangerous.
In retrieval-based systems, attackers attempt to place manipulated content inside documents that may later be retrieved by the model. If the poisoned document enters the reasoning process, the model may start following attacker-controlled instructions hidden inside what appears to be normal reference material.
Microsoft researchers have already demonstrated how indirect prompt injection can manipulate AI copilots through retrieved documents and external content pipelines, highlighting how the attack surface expands once AI systems begin interacting with external information sources.
(See: Microsoft's research on indirect prompt injection attacks against AI systems.)
Then comes memory poisoning.
Some AI systems store long-term conversational or behavioral context to improve future interactions. If malicious instructions are written into memory, the influence can persist across sessions instead of disappearing after a single request.
At that point, the attack starts behaving less like a simple jailbreak and more like persistent behavioral manipulation.
This is not a complete taxonomy of prompt injection attacks. The important takeaway is understanding how the attack surface expands as AI systems become more capable and interconnected.
Because once influence can move through retrieval, memory, tools, and external content pipelines, the problem stops being isolated to a single prompt.
And that changes the engineering question completely.
Instead of asking:
"How do we stop users from typing malicious prompts?"
The better question becomes:
"How do we control what influence different parts of the system are allowed to have?"
Why Perfect Detection Is Probably Impossible
📫 Let's connect on
Thanks for spending your precious time reading this. It's my personal take on a tech topic, and I really appreciate you being here. ❤️
SOCIAL SHARE CARD GENERATOR