In short
- Prompt injection has been LLM01, the leading entry of the OWASP list for generative AI applications, since the 2025 edition, and it is still there.
- Anthropic's September 2026 report documents an actor injecting instructions into a vendor sandbox and obtaining production API keys from multiple providers at once.
- No published control removes the class. Instructions and data arrive on the same channel, so every mitigation lowers a rate rather than closing a hole.
- Of 4 control classes in common use, only 2 keep working when the model has already been convinced.
- Article 15 of the AI Act requires high-risk systems to be resilient against attempts to exploit vulnerabilities, which is a legal reason to document what you chose and why.
What do AI assistants say about your organisation?
Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.
The uncomfortable part of prompt injection is not that it works. It is that the reason it works has not changed since it was named.
Instructions and data arrive on the same channel. A system built to follow instructions in its context will follow instructions that enter its context.
01Why has this stayed at the top of the list?
Because it is a property of the architecture, not a defect in an implementation.
Prompt injection has been LLM01, the first entry on the OWASP list for generative AI applications, since the 2025 edition. Lists like that reorder as the field matures. This entry has not moved, and the reason is structural: there is no reliable separator between the developer’s instructions and the text the model was asked to read.
The September 2026 threat report puts a concrete case behind the abstraction. An actor injected malicious instructions into a vendor sandbox and came away with production AI API keys belonging to more than one provider. The injection was not the prize. The credentials were.
02Which control classes actually help?
| Control class | What it stops | Still works after a successful injection? |
|---|---|---|
| Input and output filtering | Recognised phrasings and obvious patterns | No |
| Instruction hierarchy and delimiting | Casual and low effort attempts | No |
| Permission scoping | Nothing, by design | Yes, bounds the outcome |
| Approval gates on irreversible actions | Nothing, by design | Yes, requires a human |
The table splits into two halves and the split is the argument. The first two classes lower the number of attempts that succeed. The second two decide what a successful attempt is worth.
Teams invest heavily in the first half because it feels like defence. The second half, scope and approval gates, is the part that turns a breach into a rollback.
03Where does retrieval change the picture?
It moves the attacker from your users to your sources.
Direct injection requires someone to type into your product. Indirect injection arrives inside content the model fetches while doing its job: a web page, a support ticket, a PDF in a shared drive, a code comment. The model reads it because reading it is the task.
That is why retrieval augmented systems need a rule that pure chat interfaces do not: content fetched at runtime is untrusted input, and anything the model decides to do because of it inherits that status. In practice that means retrieved content should not be able to expand the agent’s tool access, and tool calls that originate downstream of retrieval deserve tighter gating than ones that follow a direct user request.
04What does the regulation expect?
Documented reasoning, not a specific product.
| Requirement | Provision | Applies from |
|---|---|---|
| Resilience against exploitation attempts | Article 15 | 2 Dec 2027 |
| Effective human oversight | Article 14 | 2 Dec 2027 |
| Automatic event recording | Article 12 | 2 Dec 2027 |
| Prompt injection ranked first | OWASP LLM01 | 2025 edition |
Article 15 does not name prompt injection and will not. What it asks for is an appropriate level of robustness and cybersecurity, including resilience against third parties attempting to alter use or performance by exploiting vulnerabilities.
The way that obligation is met, in practice, is a written record: these are the attack classes we considered, these are the controls we chose, this is what we accepted and why. An organisation with no such record is not non-compliant by definition, but it has nothing to show when asked.
05What is the honest summary for a risk register?
One line, and it should not promise elimination.
Prompt injection is an accepted open risk with compensating controls, the compensating controls are scope limitation and approval gates on irreversible actions, and the residual risk is that a convinced agent performs an authorised action badly.
That entry is defensible in front of an auditor. An entry claiming the risk is mitigated by input validation is not, because the first person to test it will show otherwise.
06Frequently asked questions
Can prompt injection be prevented?
Not as a class. Instructions and untrusted content reach the model through the same channel, so a system that can follow instructions in its context can be given instructions by whatever enters that context. Published mitigations reduce the success rate.
Does an input filter stop prompt injection?
It stops the attempts it recognises. Filters catch known phrasings and obvious patterns, and they are worth having, but they are pattern matching against an attacker who can rephrase, encode or split the instruction across turns.
What is indirect prompt injection?
An injection that arrives inside content the model retrieves rather than inside what the user typed. A web page, document or ticket can carry instructions that the model reads as part of doing its job, which is why retrieval expands the attack surface.
What does the EU AI Act require here?
For high-risk systems, Article 15 requires an appropriate level of accuracy, robustness and cybersecurity, including resilience against attempts by unauthorised third parties to alter use or performance by exploiting vulnerabilities. It does not prescribe a specific control.
07References and method
- OWASP Top 10 for LLM Applications, 2025 edition, where prompt injection is ranked LLM01. Cited for the ranking and for the framing of prompt injection as an open class.
- Anthropic, Countering misuse of AI: September 2026, for the case in which malicious instructions were injected into a vendor sandbox to obtain production AI API keys from several providers.
- Regulation (EU) 2024/1689, Article 15, for the accuracy, robustness and cybersecurity obligations applying to high-risk AI systems.
- The four control classes and their ratings are editorial, prepared by The Guardrail. They summarise widely used approaches and are not drawn from a benchmark or a published standard.