// GLOSSARY

Prompt Injection

Input that changes a generative-AI model's behavior in a way it was not designed for. Its direct form comes with the user's prompt; its indirect form is triggered when content from external sources the model reads (a web page, file, RAG document, email) is interpreted by the model as instruction. It ranks first in the OWASP LLM Top 10 (LLM01), and this prioritization is no accident; its root cause is not a misconfiguration but the architecture itself. In traditional software, code and data flow through separate channels, and this separation is the foundation of security; in a language model, instruction and data arrive through the same channel, within the same natural-language stream, and the model cannot cleanly separate the two. It cannot know in principle whether an input telling it 'ignore the following text' came from a user or from a document it is reading. So prompt injection is not a vulnerability closable with a single patch but a design boundary that must be managed; the defense rests not on 'sanitizing' the input but on limiting the model's authority and the surface on which it can act.