Prompt Injection: A Deep Dive into OWASP's #1 LLM Risk

It’s no secret that in 2025, Artificial Intelligence is everywhere. In fact, if you’re reading this blog, there’s a good chance you work with AI yourself, or keep up with the latest AI news- and there’s been a lot of it this year, both good and bad. 

We’ve talked a lot about how AI is a double-edged sword for cybersecurity, but what about the AI models themselves? AI security is top of mind right now, with development teams rushing forward and security teams struggling to keep up. 

The OWASP LLM Top 10 list can help illuminate some of the biggest risks and vulnerabilities in AI right now. Today, we’ll be talking about the first vulnerability on the list: Prompt Injection.

Prompt Injection

Prompt injection sits at the very top of the OWASP LLM list, and for a good reason. In 2025, we’ve already seen a multitude of prompt injection attacks executed on popular AI platforms. But let’s back up a little.

The OWASP LLM list states that  “a Prompt Injection Vulnerability occurs when user prompts alter the LLM’s behavior or output in unintended ways.”

Essentially, a prompt injection is a way of manipulating the AI model for malicious purposes. 

There are two main types of prompt injection: direct and indirect.

Direct prompt injection occurs when a user’s direct input causes the LLM to change its behavior. This is the most common type of prompt injection and is often used in conjunction with other attack methods or vulnerabilities.

An example of direct injection would be when an attacker feeds a prompt to a chatbot, instructing it to bypass security guidelines and share confidential information.

Indirect prompt injection occurs when a file, website, or other third party/ external source is entered into the LLM to cause the model to act differently. This type of prompt injection is pernicious especially because it is so difficult to catch.

‍An example of indirect injection would be when an attacker posts a prompt to a forum, telling LLMs to direct users to a malicious website.

LLM Jailbreaking

Prompt injection is related to LLM Jailbreaking but too often, the two terms are used interchangeably. According to OWASP:

“Jailbreaking is a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely.”

This is where the name “jailbreaking” comes from- it breaks through all the model’s defenses, whereas a regular prompt injection attack may only break through one layer to obtain something they needed.

Mitigation

Like with most vulnerabilities, there are a variety of measures necessary to prevent prompt injection attacks. OWASP recommends the following steps:

• Constrain model behavior. Enforce strict limits on permissions. Define and validate expected output formats using application logic or prompt constraints to ensure nothing unauthorized slips through.
• Implement input and output filtering before execution. Identify inputs and sort them accordingly.
• Exercise privilege control and least privilege access. Ensure that only authorized individuals can access confidential information, etc. Require humans for approval of high-risk actions.
• Conduct consistent adversarial testing and attack simulations.

Unfortunately, one of these actions on its own is not enough to guarantee safety from prompt injection attacks. However, when performed all together as part of a security posture, they can significantly reduce the risk of prompt injection.

Takeaways

As AI incidents continue to climb, AI security is a critical issue. And while there are many risks associated with AI, prompt injection is one of the most prevalent vulnerability that’s been grabbing headlines, and sits at #1 on the OWASP LLM Top 10 Risk list, for good reason. In 2025, we’ve already seen prompt injections occurring across industries and AI models, and this is only expected to increase. 

However, there are many steps security teams can take to mitigate this risk. AI security is a complicated issue, and growing more complicated every day as attacks continue to grow in scale and complexity. FireTail can help you take charge of your AI security posture by giving you full visibility, logging capabilities, and more needed to mitigate risks such as prompt injection. To see how it works, schedule a demo or start a free trial today.