AI prompt injection and LLM security

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 1 min read · AI Governance

Prompt injection is the SQL injection of the LLM era: untrusted text that the model treats as instructions. There is no perfect fix — only layered defence.

What it is

Prompt injection occurs when untrusted input is interpreted by an LLM as instructions rather than data — making the model ignore its system prompt, reveal secrets, or take unintended actions. It tops the OWASP Top 10 for LLM applications because, unlike a classic injection, there is no clean separation of code and data in natural language.

Direct and indirect

Direct injection is a user typing a manipulative prompt. The more dangerous variant is indirect injection: malicious instructions hidden in content the model consumes — a web page it browses, a document it summarises, an email it reads, a tool output it processes. The attacker never talks to the model directly; they poison what it reads.

Why it is hard

There is no reliable way to perfectly distinguish instructions from data in free text, so prompt injection cannot be fully "fixed" the way parameterised queries fix SQL injection. Defence is about reducing blast radius, not eliminating the vector.

Layered defence

Treat the model as untrusted: give it least-privilege access to tools and data, require human approval before sensitive or irreversible actions, sanitise and constrain what it can output and do, and isolate it from secrets it does not need. SentinelPanda tracks LLM-application security controls as part of AI system governance.