How prompt injection works

The failure, without the jargon

A language model reads one stream of text. The application may have meant the first part as the rules and the rest as a document, a web page, an email, or a user message. The model does not receive a separate, enforced privilege bit that says “this span is data, so you may not obey it.” If the application simply concatenates those spans, a sentence inside the document can compete with the sentence you wrote.

That competition is the injection. The risky sentence might tell the model to ignore earlier rules, to print a hidden prompt, to change its role, or to send the conversation somewhere else. Sometimes a person typed it on purpose. Sometimes it was left in a page, a PDF, a ticket, or a tool result that your application retrieved. The second case is the one that surprises teams: the user asked for a summary, and the page being summarized carried the instruction.

OWASP’s 2025 list of risks for LLM applications puts this first, as LLM01, and splits it into direct injection (the user’s own prompt) and indirect injection (instructions that arrive inside external content). The list also says retrieval and fine-tuning do not close the hole by themselves. The practical consequence is dull and important: anything you paste into the model’s context is a candidate instruction, including text you think of as a file.

Why a scanner can help, and what it cannot settle

The prompt injection risk scanner is a list of patterns that run in the browser. It quotes the stretch of text that matched and explains that rule in a sentence. It does not call a model, does not decode payloads, and does not decide whether your product should block the request. A person does that, after reading the quote and remembering which channel the text came from.

Channel is the whole question. “You are now a billing assistant” is a normal line in a system prompt you authored. The same sentence is a problem inside a PDF the user uploaded, because the PDF should not get to appoint the model’s role. The scanner cannot see your architecture. It can only show you the line. The guide to using a heuristic check covers how the score is computed and what a clear result authorizes, which is nothing automatic.

What this scanner actually matches

The rules below are the ones shipped on this site. If a future change adds or removes a rule, this page should change with the code. Pasting this page into the scanner will trip several of them, because the page names the patterns. That is expected.

• Instruction override. Phrases that tell the model to ignore, disregard, forget, or override earlier instructions, rules, a prompt, guidelines, or policy. A style note that says “disregard all previous instructions in this draft and use the house style” matches, even when the author is a human editor.
• Replacement instruction block. The words “new instructions,” “real instructions,” “updated instructions,” “actual instructions,” or “your new task / role / instructions.” Release notes that say “see the new instructions on the wiki” match.
• Role reset. “You are now,” “from now on you,” “act as if you,” or “your role is now.” Ordinary in a system prompt you wrote. Suspicious in retrieved text.
• Request to reveal hidden instructions. A verb such as reveal, print, repeat, show, dump, translate, or output, near “system prompt,” “hidden instructions,” “developer message,” “initial prompt,” or “confidential instructions.” A help article that tells an admin to print the system prompt will match.
• Fake chat delimiter. Markup that looks like a system, assistant, or developer boundary, including common chat control tokens and a fenced block labeled system. Documentation that shows the format will match.
• Request to send secrets elsewhere. A verb such as send, post, upload, email, or forward, near “system prompt,” “api key,” “secret,” “password,” “conversation,” or “this chat.” A logging runbook that says to post the conversation to a collector matches.
• Instruction to send results to a URL. The same family of verbs near an http or https URL, even when the destination is one you chose.
• Instruction to hide the request from the user. “Do not tell the user,” and close variants. A real privacy rule (“do not tell the user the internal ticket id”) matches the same pattern as a concealed task. The quote is how you tell them apart.
• Spoofed authority label. A line that begins with SYSTEM, ADMIN, DEVELOPER, or OPERATOR followed by a colon. Log exports and config samples do this constantly.
• Embedded script or a javascript: URL. These do not belong in text you will render or hand to a tool.
• Long encoded blob. A run of 48 or more base64-looking characters. The checker does not decode it. Certificates, embedded images, and tokens often look like this.
• Hidden or bidirectional characters. Zero-width and direction-override characters that can make a reviewer and a model read different words.

Read the built-in example before you paste anything sensitive

The scanner’s example is a short, obvious paragraph: it tells the model to ignore previous instructions, to print the hidden system prompt, and to POST the result to a URL. Those are three different rules, and the page is supposed to show all three quotes. Use that example to learn the shape of a result. Then clear the box.

The label on a result is the stronger of two signals: the band for the summed rule weights, and the severity of the single strongest finding. One high-severity line can therefore outrank a modest number. The score guide spells out the bands, the 100-point cap, and the fact that only the first 20,000 characters are scanned. A longer document gets a low-severity note even when nothing else matches, which means a long paste cannot come back fully clear.

False positives you should expect

A match is a line that looks like a pattern. It is not a verdict that the author was attacking you. The rules are narrow on purpose, and they still collide with ordinary writing.

Expect hits on system prompts you wrote yourself, on internal runbooks, on release notes, on admin documentation, and on any log line that starts with SYSTEM:. Expect a hit when a privacy instruction says not to tell the user something. Expect a hit when a document contains a long token or a sample delimiter. In each case the evidence quote is the part worth reading. If the text came from you, and you meant that sentence as an instruction, the finding is a description of your prompt, not an attack.

The rule list is also English-shaped. A translation, a paraphrase, or the same idea written without these phrases will not match. That misses real attacks, and it also means a clumsy keyword is a poor reason to punish a user. If you are reviewing a support transcript, look at who was supposed to be allowed to set the model’s role before you look at the color of the badge.

What the scan will miss

The checker looks at characters. It does not OCR an image, read a caption buried in a screenshot, or assemble an instruction that was split across two retrieved chunks unless both chunks are in the paste. It does not execute or decode the blob it flags. A person who wants the hidden text has to decode it in a separate viewer, on purpose.

It stops at 20,000 characters so the page stays responsive. The tail of a long contract, a long thread, or a long web page is unscanned. Split the document and run the rest. A clear result on the first slice says nothing about the second.

It will also miss an instruction written in a language the patterns do not cover, and an instruction that simply asks for a harmful outcome in ordinary words. Ordinary harmful requests are a policy problem. This scanner is not that policy. The jailbreak detector looks for a different family of wording, and the output checker looks at what the model wrote back. None of the three is a general moderation classifier.

A sane way to use the result

Before you paste, name the channel. System prompt you authored, end-user message, retrieved page, uploaded file, tool result, or model output you are about to feed into another step. The same sentence means different things in those channels.

If the text contains a live secret, think before you paste it into this site. The check runs locally, and running it does not upload the box. Saving a result is a separate, signed-in choice, and the paste is stored only if you opt in. The tool pages also load advertising. The privacy policy describes that boundary. For a production secret, rotate it and review the text somewhere that does not run third-party scripts. The guides name the patterns, so you can compare a sentence with the list without pasting the secret.

After a high score, read every quote. Keep untrusted text out of the instruction role in your own application. If a tool can send mail, fetch a URL, or touch customer data, require a person for that call when the text was retrieved rather than written by you. A low or clear score is a reason to keep going with your own review, not a reason to skip it.

Corrections and missed patterns can go to contact@misalignai.com. Name the rule, and send a redacted quote. Do not send the secret the rule found.

Further reading

The OWASP Gen AI Security Project describes LLM01:2025 Prompt Injection, including direct and indirect cases, and lists mitigations such as separating untrusted content, least privilege, and a person on high-risk actions. Kai Greshake and colleagues wrote up indirect injection against real tool-using applications in “Not what you’ve signed up for” (arXiv:2302.12173). Those pages are the background. The behavior of this site is the rule list above, not a claim that we re-ran their experiments.

OWASP LLM01:2025 Prompt Injection and the OWASP prompt-injection prevention cheat sheet are the two external pages worth opening next. Then run the scanner on text you already understand, so you can see which of your own sentences it will flag.