iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Under Simon Willison’s March 2024 definition, a hostile instruction only counts as prompt injection when an application mixes untrusted input into a prompt that a developer wrote. If the attack tries to get a model to ignore its own safety behavior without any such mixing, Willison calls it a jailbreak. The split is useful for deciding who has to fix a problem, but it is one author’s taxonomy. OWASP’s 2025 list for LLM applications draws the boundary more broadly, and you should know both views before you label an incident.
Willison’s test in one sentence
In the article Prompt injection and jailbreaking are not the same thing, published March 5, 2024, Willison defines prompt injection as an attack on applications built on large language models. The attack works by concatenating untrusted user input with a trusted developer prompt. He ties the name to SQL injection, where data is spliced into a query and gets executed as code. His summary of the test reads: “Crucially: if there’s no concatenation of trusted and untrusted strings, it’s not prompt injection.”
Jailbreaking, in the same article, is an attempt to subvert the safety filters built into the model itself. The target is the model’s behavior, not the application’s data flow.
Two cases that look alike
The two categories are easiest to see side by side. The table below applies Willison’s framing to each.
#1 Best Overall
| Question | Jailbreak (Willison’s usage) | Prompt injection (Willison’s usage) |
|---|---|---|
| What is attacked | The model’s built-in safety filters | An application that combines its own prompt with outside content |
| Where hostile content enters | Directly in the conversation with the model, with no application-built prompt involved | Inside data the application pulls in, such as a document, email, or webpage, and joins to its trusted instructions |
| What a successful attack gains | Output the model would normally refuse to give | Whatever the application can reach, such as private data or the ability to call tools |
| Main place to fix it | The model and its safety training, plus the provider’s filters | The application’s design: how it builds prompts, what it can access, and what needs approval |
Case 1: a user argues a standalone model past its refusals
Someone types a role-play request into a chat interface, asking the model to pretend it has no restrictions and to answer a question it would normally decline. No developer prompt is merged with anything the user supplied from an outside source. The attack targets the model’s safety behavior, so Willison would classify it as a jailbreak.
Case 2: instructions hidden in content the application reads
An assistant summarizes incoming email. Its developer prompt says to summarize the message and never send mail. A sender includes text telling the assistant to forward the user’s recent messages to an outside address. The application has combined its trusted prompt with untrusted email text, which is the pattern Willison calls prompt injection. Whether the attacker’s text succeeds depends on what the assistant is allowed to do, which is the next question.
Why application permissions decide severity
Willison’s point is that the risk of prompt injection rises with what the application can touch. He gives the example of an application with access to confidential information or privileged tools, such as searching email and forwarding it. Before you rate an incident, check the application’s reach:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Can the model read private data, such as mailboxes, customer records, or internal documents?
- Can it call tools that send messages, change records, make purchases, or run code?
- Can it send information to destinations outside the organization?
- Does a person have to approve high-risk actions before they run?
An injected instruction against an application with no private data and no outbound tools has a much smaller potential impact than the same instruction against an assistant that can read and forward email.
Where OWASP draws the line differently
The OWASP GenAI Security Project’s entry LLM01:2025, Prompt Injection, describes direct and indirect prompt injection. Direct injection comes from the user’s own input. Indirect injection comes from external content the application processes. Unlike Willison’s usage, OWASP treats jailbreaking as a form of prompt injection. That is a difference in scope and classification, not evidence that either side is wrong. The OWASP Top 10 for LLM Applications page identifies its 2025 list as the current version in the material reviewed for this article, so a report that cites the 2025 list is using OWASP’s present vocabulary.
The two frameworks also overlap in practice. Willison notes that some jailbreaks use prompt injection, and that defenses built against prompt injection can be defeated by jailbreak techniques. A single attack may therefore be both, and an incident report should say which parts of it succeeded and against what.
Mitigation is layered, not guaranteed
OWASP’s 2025 guidance recommends several measures that work together:
Recommended Free Tools
- Limit the privileges of the model and its tools to the minimum the task needs.
- Require human approval for high-risk operations.
- Clearly separate and identify external content from trusted instructions.
- Run adversarial testing against the application on a regular basis.
OWASP is explicit about the limits of this work. Its text says: “Given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection.” Delimiters, carefully written system prompts, and injection detectors are useful components. None of them should be treated as a complete guarantee, and none of them addresses the permissions problem on its own.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Applying the distinction
- Map every input the model sees. Mark which parts are written by your developers and which come from users, files, emails, or web pages.
- If untrusted content is combined with your trusted prompt, treat the attack as prompt injection under Willison’s test and assess it through the application’s permissions.
- If the attack only tries to get past the model’s refusals, treat it as a jailbreak under Willison’s test, and remember that OWASP would also file it under prompt injection.
- Record both labels when an attack does both, along with the permissions the application had at the time.
The useful question is not which word to use. It is what the application could do once the hostile text was inside its prompt.
These definitions reflect a 2024 essay and a 2025 framework. Both may be revised, so check the current versions before using either as a formal reference.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
