AI Governance Engineer
GitHub

Prompt injection

By Updated

An input that alters a model's behaviour or output in ways its designers did not intend. It is direct when the user supplies it and indirect when it arrives inside content the model processes, such as a web page, file or tool result 1. Contained by guardrails, least-privilege tools and evals.

Developed in
ch. 04, Layer 04: Runtime Controls & Observability
Chapters
ch. 01, Definition · ch. 04, The Stack · ch. 17, Incidents · ch. 23, AI Agents
Contrast with
Jailbreak · Hidden Context Exposure
Source
1 numbered reference, listed below

Commonly confused

  • Prompt injection versus Jailbreak

    Prompt injection
    An input that alters a model's behaviour or output in ways its designers did not intend.
    Jailbreak
    A prompt crafted to make a model disregard its safety instructions entirely.

    The differenceAny input that alters behaviour in unintended ways, direct or hidden in processed content, against inputs aimed at dropping the safety rules.

    Why it mattersJailbreak evals test refusals; injection also needs least-privilege tools and isolation of untrusted content.

Where it is used

12 chapters of the Body of Knowledge use the term. Each link opens the first section that does.

Prompt injection: mentions per chapter21 mentions of the term across 12 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter01 Definition: 2 mentions01 Definition202 Why Now: 2 mentions02 Why Now203 Values & Principles: 1 mention03 Values & Principles104 The Stack: 2 mentions04 The Stack210 Reading List: 1 mention10 Reading List112 Governance Program: 1 mention12 Governance Program113 Risk Management: 1 mention13 Risk Management114 Development: 1 mention14 Development115 Deployment: 2 mentions15 Deployment217 Incidents: 5 mentions17 Incidents520 Existing Law: 1 mention20 Existing Law123 AI Agents: 2 mentions23 AI Agents2No mentions in the other 11 chaptersSource: the Body of Knowledgev0.5.0
Prompt injection: mentions per chapter21 mentions of the term across 12 of the 23 chapters of the Body of Knowledge; the chapters the glossary cross-references are drawn solid.Cross-referenced chapterOther chapter0001 Definition: 2 mentions20102 Why Now: 2 mentions20203 Values & Principles: 1 mention10304 The Stack: 2 mentions2040506070810 Reading List: 1 mention1101112 Governance Program: 1 mention11213 Risk Management: 1 mention11314 Development: 1 mention11415 Deployment: 2 mentions2151617 Incidents: 5 mentions517181920 Existing Law: 1 mention120212223 AI Agents: 2 mentions223Source: the Body of Knowledge v0.5.0
Mentions per chapter How often each chapter names the term, with the chapters the glossary cross-references drawn solid. The longest bar is where to read the term in use; bars spread across many chapters mark a term that runs through the discipline.
Mentions as a table
Mentions of Prompt injection per chapter
ChapterMentionsCross-referenced
00 Preface0No
01 Definition2Yes
02 Why Now2No
03 Values & Principles1No
04 The Stack2Yes
05 Patterns0No
06 The Role0No
07 Maturity Model0No
08 Regulatory Map0No
10 Reading List1No
11 AI Defined0No
12 Governance Program1No
13 Risk Management1No
14 Development1No
15 Deployment2No
16 Fairness & XAI0No
17 Incidents5Yes
18 EU AI Act0No
19 Privacy & AI0No
20 Existing Law1No
21 AI Laws Worldwide0No
22 Principles & Standards0No
23 AI Agents2Yes

Patterns that use this term

4 pattern pages use the term, most mentions first.

Prompt injection: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern01 Govern-as-Code04 Runtime Controls05 AssurancePrompt injectionRelated terms (6)CIMD · RelatedCIMDEvals · RelatedEvalsGuardian agent · RelatedGuardian agentGuardrail · RelatedGuardrailMCP · RelatedMCPWorkload identity · RelatedWorkload identityContrast with (2)Hidden Context Exposure · ContrastHidden Context ExposureJailbreak · ContrastJailbreakPatterns using it (4)AI Threat Model, 1 mention · Uses the termAI Threat ModelIncident Pipeline, 1 mention · Uses the termIncident PipelineKill Switch / Circuit Breaker, 1 mention · Uses the termKill Switch / Circuit BreakerRuntime Guardrail, 2 mentions · Uses the termRuntime Guardrail
Prompt injection: related terms and patternsThe term at the centre; related terms on solid edges, the terms it is contrasted with on dashed edges, and the patterns that use it most in the colour of their layer.RelatedContrastColour: stack layer of the pattern01 Govern-as-Code04 Runtime Controls05 AssuranceRelated terms (6)CIMD · RelatedCIMDEvals · RelatedEvalsGuardian agent · RelatedGuardian agentGuardrail · RelatedGuardrailMCP · RelatedMCPWorkload identity · RelatedWorkload identityContrast with (2)Hidden Context Exposure · ContrastHidden Context ExposureJailbreak · ContrastJailbreakPatterns using it (4)AI Threat Model, 1 mention · Uses the termAI Threat ModelIncident Pipeline, 1 mention · Uses the termIncident PipelineKill Switch / Circuit Breaker, 1 mention · Uses the termKill Switch / Circuit BreakerRuntime Guardrail, 2 mentions · Uses the termRuntime GuardrailPrompt injection
The term's neighbourhood Terms related to this one on solid edges, terms it is often confused with on dashed edges, and the patterns that use it most in the colour of their layer. Follow a dashed edge to check the distinction before you use either term.
Neighbourhood as a table
Neighbourhood of Prompt injection
FamilyItemRelation
Related termsCIMDRelated
Related termsEvalsRelated
Related termsGuardian agentRelated
Related termsGuardrailRelated
Related termsMCPRelated
Related termsWorkload identityRelated
Contrast withHidden Context ExposureContrast
Contrast withJailbreakContrast
Patterns using itAI Threat Model, 1 mentionUses the term
Patterns using itIncident Pipeline, 1 mentionUses the term
Patterns using itKill Switch / Circuit Breaker, 1 mentionUses the term
Patterns using itRuntime Guardrail, 2 mentionsUses the term
  • CIMD

    Client ID Metadata Document: the mechanism by which an OAuth client identifies itself with a URL, used as its client ID, that points to its metadata document.

  • Guardian agent

    An AI agent whose job is to supervise, check or constrain other agents at runtime; Gartner predicts guardian-agent technologies will account for at least 10…

  • MCP

    Model Context Protocol: an open protocol for connecting AI applications to tools and data sources; its 2026 specification adds OAuth 2.1 resource-server…

  • Workload identity

    The attributable identity a workload such as an agent carries across every hop, under which its actions are logged and its access is revoked, typically a…

  • Guardrail

    A runtime control that inspects or mediates a model's or agent's inputs, outputs or tool calls and blocks, rewrites or escalates what breaks a policy, logging…

  • Evals

    Automated tests of a model's or agent's behaviour (capability, safety and adversarial), run as controls, not as one-off research.

Sources

  1. [1] LLM01:2026 Prompt Injection (OWASP Top 10 for LLM Applications 2026; direct and indirect injection; jailbreaking as the subset of prompt injection that aims to make the model violate its safety protocols; entry text in github.com/GenAI-Security-Project/GenAI-LLM-Top10, 2026/final). OWASP GenAI Security Project. 2026-08-03. https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/ (verified: primary)

Definitions of legal terms paraphrase the cited text, which governs. Dated statements are as of .

Cite this term

García Aibar, J. (2026). Prompt injection. In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0), Glossary. https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/glossary/prompt-injection. CC BY 4.0

BibTeX

@misc{aige2026promptinjection,
  author  = {Jorge García Aibar},
  title   = {{Prompt injection}},
  note    = {Glossary, AI Governance Engineering: The Thesis \& Body of Knowledge, version 0.5.0},
  year    = {2026},
  doi     = {10.5281/zenodo.22956197},
  url     = {https://aigovernanceengineer.com/glossary/prompt-injection}
}