Free tools Windows power users keep installed
One-click scans. No signup required.
Prompt injection cannot currently be prevented with a guarantee that every attack will fail. The practical security goal is to limit what an influenced model can see and do, then enforce permissions and approvals in the application around it. OWASP’s guidance treats prompt injection as an application-security risk and recommends layers of controls—not a fool-proof filter.
What prompt injection is—and where it can come from
Prompt injection is an attempt to change an LLM’s intended behavior by supplying instructions through content the model processes. OWASP Gen AI Security Project’s LLM01:2025 Prompt Injection describes the issue as user prompts changing model behavior or output in unintended ways. The instructions do not have to be visible to a person if the model can parse them.
Direct injection
A direct injection appears in the user’s message—for example, a request that tells the model to ignore its prior instructions or reveal information it should not disclose.
Indirect injection
An indirect injection arrives in external material the model is asked to process: a webpage, a retrieved document in a retrieval-augmented generation (RAG) system, or an email. OWASP’s examples also include instructions split across parts of a resume and instructions embedded in an image for a multimodal model. Checking only the visible user message therefore leaves other input channels unexamined.
#1 Best Overall
Prompt injection and jailbreaking
The terms are sometimes used interchangeably, but OWASP distinguishes them: prompt injection is the broader manipulation of model responses; jailbreaking is a form that tries to make the model disregard its safety protocols. Not every prompt injection is a jailbreak.
What a successful injection can do
The consequence depends on the application and the model’s agency—what data it can access, which tools it can invoke, and which actions it is allowed to take. Outcomes can include manipulated answers or decisions, disclosure of information, unauthorized function access, or commands that affect connected systems. A chatbot that only drafts text has a different exposure from an agent that can search private records or operate business tools.
Rank #2
A malicious instruction in a webpage may try to influence a summary. In an application that also grants access to sensitive data or tools, the risk is not limited to a misleading summary: the model may be induced to use capabilities the application has made available. The security boundary is therefore the whole system, not just the prompt.
Why “stop every exploit” is not a defensible guarantee
LLMs generate responses probabilistically, and prompt wording is not an access-control mechanism. OWASP Gen AI Security Project puts the limitation plainly in LLM01:2025 Prompt Injection: “Given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection.” This is a statement about the limits of current prevention guidance, not a mathematical claim about every possible future model or defense.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteInstructions such as “ignore malicious content” can guide a model, and filtering, training, or output checks may reduce risk. But none should stand in for enforcing permissions in application code. OWASP also cautions that RAG and fine-tuning do not fully mitigate prompt injection. The more reliable objective is to constrain the impact if the model is influenced.
Choose controls by the boundary they protect
These controls address different parts of an LLM application. OWASP’s guidance does not establish comparative success rates, so the table describes their role rather than ranking their effectiveness.
Rank #4
| Control | Boundary it protects | Practical use | Important limit |
|---|---|---|---|
| Separate untrusted content | Input and instruction handling | Mark retrieved or user-provided material as untrusted and keep it distinct from system and developer instructions where possible. | Delimiters or labels help communicate trust boundaries; they are not, by themselves, a security guarantee. |
| Least privilege | Tool invocation and data access | Give the model only the permissions needed for the task, and enforce authorization outside the model. | It reduces the reach of an attack but does not ensure the model will interpret every input correctly. |
| Validate outputs and actions | Output and downstream systems | Check expected formats and validate proposed tool calls in application code before acting on them. | Validation must match the actual action and data being protected; a well-formed output is not necessarily a safe one. |
| Human approval | High-impact actions | Require review before consequential operations, such as sending or deleting messages. | Approval is a gate for specific actions, not a substitute for restricting unnecessary access. |
| Adversarial testing and monitoring | Trust boundaries across the application | Use penetration testing and attack simulations to probe input channels, permissions, and tool behavior. | Testing can reveal weaknesses but cannot prove that every future attack will be blocked. |
| Keep secrets out of prompts | Credential and authorization handling | Store credentials outside prompts and enforce authentication and authorization independently. | A system prompt should not be treated as secret or as a security control. |
These measures work best as layers. Model guidance can steer behavior; application checks decide whether a requested action is permitted. If a model proposes an action, treat the proposal as untrusted until the application has checked its scope and authorization.
Design agent permissions around the damage an attack could cause
OWASP’s LLM06:2025 Excessive Agency describes an email assistant that can read messages and also send them. A malicious email could influence the model to search the inbox and forward sensitive information. The safer design is to remove capabilities the task does not require: use read-only access when reading is sufficient, omit send functionality if it is unnecessary, and require the user to review outgoing messages.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Apply the same reasoning to other tools: separate read from write access where possible, limit access to the relevant data, and put consequential actions behind an approval step. Reducing an agent’s authority limits the reach of an injection even when other defenses fail.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.A practical security review for an LLM application
- Map every input channel. List user prompts and every external source the model processes, including retrieved files, webpages, messages, and multimodal inputs.
- Inventory data and tools. Identify what the model can read, which functions it can call, and what those functions can change or disclose.
- Enforce permissions outside the model. Check identity, authorization, and task scope in application code; do not rely on prompt instructions to deny access.
- Remove unnecessary agency. Reduce permissions and tool capabilities to the minimum needed, separating read-only work from actions that change or send data.
- Validate before execution. Check model outputs and proposed tool calls against expected formats, allowed operations, and authorized data scopes.
- Gate consequential actions. Require a person to approve high-impact operations before the application executes them.
- Test the trust boundaries. Simulate hostile or misleading content from each input channel and assess whether it can expose data or trigger an action. Revisit the tests as tools and permissions change.
How to judge a proposed defense
Ask five questions before relying on a control:
- Which boundary does it protect: input, model behavior, output, tool invocation, or downstream data?
- Does it merely guide the model, or does application code enforce the rule?
- What data and permissions remain available if the model is influenced?
- Which high-impact operations require human approval?
- How will the control be tested and monitored as the application changes?
OWASP’s related LLM07:2025 System Prompt Leakage guidance reinforces a key design principle: system prompts should not contain credentials or serve as a security boundary. Keep secrets and authorization decisions in mechanisms built for those jobs.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
