New: AI Workspace – Secure AI for Organizations With Sensitive Data. Learn more.

Prompt Injection: Examples, Jailbreaks, and Protective Measures

Cybercriminals use prompt injections and jailbreaks to bypass safeguards in AI language models and execute potentially harmful or illegal prompts.

Code on a screen

At one look

  1. 1. Direct and Indirect Prompt Injection: Differences from Jailbreaking
  2. 2. Prompt Injection: Real-World Examples
  3. 3. Multi-layered protection against prompt injection
  4. 4. Limits of Protection
  5. 5. Implementing Safety Measures at the Company

Prompt Injection & Jailbreaks in a Nutshell

Prompt injection is an attack in which injected instructions are intended to divert an AI language model from its intended task. The instructions appear directly in an input or in documents, web pages, and emails that the model processes. Possible consequences include distorted responses, unintended actions, and data leaks.

A specific type of this attack is the AI jailbreak, which aims to circumvent the model’s security protocols. Anyone using AI in a business setting should be aware of both types of attacks. Protection requires several coordinated measures. A central security layer between users and AI models—such as the one offered by Myra AI Workspace—can handle part of this.

What Is Prompt Injection? Definition and Causes

Language models cannot reliably distinguish between trustworthy instructions and untrustworthy content. As early as 2023, the BSI classified this characteristic as an intrinsic vulnerability of application-integrated AI language models. OWASP also noted in 2026 that, architecturally, language models do not distinguish between instructions and data. Prompt injection exploits this weakness: The model treats injected text as an instruction, even though it should only process it as content.

In the “OWASP Top 10 for LLM Applications 2026,” prompt injection (listed as LLM01) continues to rank first among the risks for applications using large language models (LLMs). The current definition broadens the scope of the term compared to the previous version: Such a vulnerability exists when inputs alter a model’s behavior in a way not intended by the application developers. Inputs include direct user inputs, retrieved content, tool outputs, images, audio and video content, intermediate steps of the model, and stored memories.

The original English text states that the input “alters the model’s behavior in ways the application developer did not intend.”

Direct and Indirect Prompt Injection: Differences from Jailbreaking

The key factor is where the injected instruction comes from and what the attack is targeting.

Variant
Where the instruction is located
Who places them
Typical target

Direct Prompt Injection

In the application's input field

The user themselves

Circumvent application requirements or disclose system instructions

Indirect Prompt Injection

In documents, web pages, emails, or tool outputs processed by the model

Third parties, often unnoticed by those affected

Extract data, trigger actions, or falsify responses

AI jailbreak or LLM jailbreak

Usually in an input intended to circumvent the model's security measures

Usually user themselves

Generate content that the model would otherwise reject

Direct Prompt Injection

In the application's input field

Indirect Prompt Injection

In documents, web pages, emails, or tool outputs processed by the model

AI jailbreak or LLM jailbreak

Usually in an input intended to circumvent the model's security measures

According to OWASP, a jailbreak is a specific type of prompt injection: The goal is to cause the model to violate its security guidelines.

For government agencies and companies that use AI models with document uploads, the indirect variant is particularly relevant. In its September 2026 publication, “Basic Protection Against Indirect Prompt Injections in Document-Based LLM Chats,” the BSI describes how attackers embed instructions in uploaded documents, for example, using invisible Unicode characters or white text on a white background. This affects not only the visible text but also metadata, annotations, and comments. The file appears harmless when read, while the model may process the hidden content.

According to the BSI, typical consequences of successful attacks include data leaks, the disclosure of the system prompt, or tasks being performed incorrectly.

As a basic safeguard, the BSI recommends five measures that work in conjunction: sanitizing ingested content, separating trusted and untrusted content in the prompt, using a hardened system prompt, selecting a robust model with an upstream reasoning step, and filtering the model’s outputs. For AI agents, the BSI additionally recommends having security-critical actions confirmed by humans and continuously logging events.

Prompt Injection: Real-World Examples

The following examples illustrate typical attack patterns without reproducing specific attack texts.

Direct Attack on a Customer Chat

A customer chat is designed to provide information about orders. A user instructs the model to ignore its previous instructions and instead generate an internal note. This direct prompt injection is intended to divert the application from its intended task.

A Hidden Instruction in a Job Application

An assistant summarizes incoming applications. One of the files contains a hidden instruction to present the application in a particularly positive light. The indirect attack can influence the summary without the team noticing the instruction.

Data Transfer via a Tool Call

If an AI assistant is allowed to use tools, a malicious command could trigger an action—such as sending data to an external destination. The consequences are then not limited to a misleading response.

Multi-layered protection against prompt injection

No single measure provides complete protection. Companies must both detect injected instructions and limit the model's scope of action.

The following table shows layers of protection and the corresponding features in Myra AI Workspace.

Protection Layer
Measure
Implementation in Myra AI Workspace

Validate Inputs

Detect attack attempts in user inputs and external content before they reach the model

Trained classifier for prompt injection and jailbreaks, hosted on the certified Myra infrastructure in the EU. It validates user inputs as well as results from tools, web searches, and the knowledge base. Additionally, a filter detects known attack phrases, including those in tool results.

Flagging external content

Content from documents, web pages, and tools as data rather than as instructions

By default, untrusted content is automatically flagged

Filter content

Detect harmful content in requests and responses

A classifier for malicious content, such as depictions of violence, hosted on the certified Myra infrastructure in the EU. It complements attack detection but does not replace it.

Limit permissions

Limit access and tools to what is necessary for the task

Access level per project; “Local Only” blocks cloud models, web search, and external tools

Control Outgoing Calls

Review model-triggered calls

Verify model-triggered calls and search queries; blocks structured data such as email addresses or access keys

Involve humans

Approve high-impact steps before execution

Workflows with a human approval step; approve individual tool calls during unsupervised agent runs

Reduce data

Limit sensitive content in the prompt

Mask personal data before sending it to external models

Track events

Log changes and security events

Tamper-evident audit log for admin changes and security events

Validate Inputs

Detect attack attempts in user inputs and external content before they reach the model

Flagging external content

Content from documents, web pages, and tools as data rather than as instructions

Filter content

Detect harmful content in requests and responses

Limit permissions

Limit access and tools to what is necessary for the task

Control Outgoing Calls

Review model-triggered calls

Involve humans

Approve high-impact steps before execution

Reduce data

Limit sensitive content in the prompt

Track events

Log changes and security events

Restricted privileges limit the scope of action following a successful attack. A model that is not permitted to invoke tools or send data cannot perform these actions even if instructed to do so by an injected command.

OWASP emphasizes this connection in its 2026 edition: Severe consequences arise especially when a model can exercise extensive privileges following a successful injection. The list identifies excessive privileges as a separate risk, “Excessive Agency,” ranked third.

Limits of Protection

Classifiers may overlook attack attempts and incorrectly classify harmless text as an attack. Vendors should disclose these limitations. Companies should test detection using their own examples. This also applies to filters that check model outputs.

Detecting known attack phrases serves as a quick initial filter. It does not reliably detect rephrased or elaborately obfuscated attacks; that is the responsibility of the additional classifier. However, even this classifier can overlook attacks. Labeling external content reduces the risk of indirect attacks but does not prevent them.

Attack methods continue to evolve. Rules that are effective today may be circumvented later. Therefore, you should also plan for the scenario in which an attack is successful:

  • What data can the model access?

  • What actions is it permitted to perform?

  • Who will detect the incident?

Technical safeguards complement this planning but do not replace it.

Implementing Safety Measures at the Company

Take a step-by-step approach to securing your AI applications:

  1. Identify which applications process external documents or websites.

  2. Restrict the available tools and access rights in those applications.

  3. Enable guardrails so that detected attacks are blocked and logged.

  4. Test detection using non-sensitive sample text.

  5. Ensure that actions with significant consequences require human approval.

Hands pointing to a laptop screen

FAQ on Prompt Injection and AI Jailbreaks

Prompt injection refers to an attack in which injected instructions are intended to influence the behavior of a language model. These instructions can appear directly in a user's input or in external content. Possible consequences include distorted responses, unintended actions, and data leaks.

Sources

Here you will find the sources used for this article, along with their access dates.

  1. 2026

    OWASP GenAI Security Project: OWASP Top 10 for LLM Applications 2026, published on August 3, 2026

  2. 2026

    Basisschutz gegen Indirect Prompt Injections in dokumentbasierten LLM-Chats, Version 1.0, September 14, 2026

  3. 2026

    Indirect Prompt Injections – Intrinsische Schwachstelle in anwendungsintegrierten KI-Sprachmodellen, Version 1.0, July 15, 2023

About the author

Stefan Bordel

Senior Editor

About the author

Stefan Bordel has been working as Editor and Technical Writer at Myra Security since 2020. He is responsible for the strategic development and editorial management of all content formats – from website content and specialist publications to whitepapers, social media communication, and technical documentation. In this role, he combines solid expertise from IT journalism with in-depth technical understanding in the field of cybersecurity. As a long-time Linux enthusiast, he closely follows developments in the IT industry both professionally and personally.