What is prompt injection?

OWASP defines prompt injection as a vulnerability where prompts alter an LLM's behavior or output in unintended ways. That sounds abstract until you connect it to agents. In an agentic system, a malicious or malformed input can do more than change a sentence. It can influence which tool is called, what data is retrieved, and whether an action is taken.

That is why prompt injection should be treated as a control-plane problem, not just a content-quality problem. If the model can touch sensitive systems, then prompt injection becomes an access and authorization issue.

Direct prompt injection happens when the attacker puts the instruction into the message they send to the model. Indirect prompt injection happens when the attacker plants instructions in external content that the model later reads, such as a web page, email, document, issue comment, or image.

OWASP explicitly warns that indirect injections can be either intentional or accidental. In practice, that means the dangerous input might be a malicious page, but it might also be a normal business artifact that contains surprising text the agent interprets as instructions.

Microsoft's prompt-injection guidance for Semantic Kernel shows the core engineering lesson clearly: content inserted into prompts should be treated as unsafe by default and encoded unless the developer has a good reason to trust it. That is a far stronger pattern than hoping the model always remembers which text is authoritative.

OpenClaw's own security docs say something similar in operational language. Prompt guardrails reduce abuse risk, but hard enforcement comes from policy, sandboxing, authentication, allowlists, and downstream authorization. In other words, models can assist with security, but they cannot replace it.

There is no magic prompt that permanently solves injection. The practical goal is to make injected instructions less likely to succeed and far less damaging when they do.