The vocabulary, defined plainly

Prompt injection glossary

The field borrows words from security, from machine learning and from the vendors, and uses several of them loosely. These definitions are the ones this site uses, grouped by what they describe, with the source that fixed each term where one exists.

Published 5 September 2026
By the Prompt Injection Scanner editorial team (Mothership Engineering)
Every claim traces to the primary references listed at the foot of the page

The basics

The terms you need before the others make sense.

Prompt: the text a language model receives before it generates a reply, including anything the application adds around what the user typed.
System prompt: instructions the application’s developer places ahead of the conversation to set the model’s task, persona and rules. Bing Chat’s “Sydney” instructions, extracted in February 2023, were a system prompt.
Context window: everything the model can see at once, including the system prompt, the conversation, retrieved documents and tool results. Anything in it can influence the output.
Instructions versus data: in ordinary software these are separate; inside a language model they are not. The UK NCSC’s phrase is that there is only ever the next token.
Untrusted content: any text the user did not write and cannot vouch for, such as an email, a web page, a retrieved document or a tool’s output.

The attack

Names for the ways untrusted text becomes an instruction.

Prompt injection: text that makes an AI system treat untrusted content as an instruction. Coined by Simon Willison in September 2022 by analogy with SQL injection; listed first in OWASP’s Top 10 for LLM Applications as LLM01.
Direct prompt injection: the person using the system supplies the injected text, for example to override or extract the system prompt.
Indirect prompt injection: the injected text arrives inside content the system reads, such as an email or a page. Named by Greshake and colleagues in February 2023.
Jailbreak: an attack on the model’s own safety training, aimed at making it produce content it would refuse. Not the same as injection; the victim is the vendor’s policy rather than the user.
Promptware: Nassi, Cohen and Yair’s term for prompts engineered to compromise the confidentiality, integrity or availability of an application, delivered through routine channels such as calendar invitations.
Toxic agent flow: Invariant Labs’ term for an indirect injection that triggers a sequence of otherwise legitimate tool calls, such as reading a private repository and publishing it.
Zero-click: an attack that needs no action from the victim beyond receiving the content and using the system normally. EchoLeak, CVE-2025-32711, was described by its finders as the first such attack on an AI assistant.

Where it arrives

The systems and mechanisms through which text reaches a model.

Agent: a model wired to tools that can act, such as a mailbox, a browser or a code repository, usually across many steps without a person watching each one.
Tool call: a request from the model to run a function, fetch a page, send a message or change a record. The step at which an injected instruction becomes an action.
MCP (Model Context Protocol): a standard for connecting assistants to tools and data sources; GitHub’s MCP server was the setting for the May 2025 private-repository leak.
RAG (retrieval-augmented generation): a design in which the system searches a store of documents for passages relevant to the question and places them in the context window before the model answers.
Retrieval: the search step in RAG. Relevance ranking is not trust ranking; a stranger’s text and the user’s own notes arrive with the same standing.
Poisoning: placing content in a store the system will later retrieve, so that the injection persists and reaches many queries.
Rules file: a configuration file that shapes how a coding assistant behaves; the carrier in the March 2025 Rules File Backdoor.

How text hides

The channels a reader does not see and a model does.

Hidden channel: any part of a document that carries text without displaying it, such as an HTML comment, a hidden element, alternative text, metadata or a link destination.
Zero-width character: a character with no visible glyph, such as the zero-width space or joiner, legitimate in emoji sequences and some scripts and abused to hide text.
Bidirectional control: a character that changes the direction in which text is laid out, needed for mixed Arabic or Hebrew and Latin text and abused in Trojan Source to make code read differently from how it compiles.
Unicode Tags block: code points U+E0000 to U+E007F that mirror ASCII and render as nothing; an instruction written in them is invisible to a person and legible to a model.
ASCII smuggling: Johann Rehberger’s name for hiding text with the Tags block, in either an input to a model or its output.
Confusable or homoglyph: a character that looks like another, such as Cyrillic and Latin letters; Unicode Technical Standard #39 defines how to compare them.
Encoded payload: an instruction written in Base64, percent-encoding or HTML entities so that it does not read as words until decoded.

What it does

The consequences and the conditions for them.

Exfiltration: moving private data out of the system, typically through a rendered image, a link or a tool call.
Markdown image exfiltration: an exit in which the model emits an image whose URL carries data to an attacker’s server; first shown against Bing Chat in April 2023.
Lethal trifecta: Willison’s name for the combination of private data, untrusted content and an outbound channel that makes data theft possible in an agent.
Integrity attack: an injection that changes a decision rather than stealing data, such as hidden text that tells a screener to rate a résumé favourably.
Exit: the channel through which an injected instruction produces an effect outside the conversation. Closing exits is most of practical defence.

Defences

The measures that recur across the guides, in rough order of strength.

Least privilege: giving the model and its tools the narrowest access a task needs. The NCSC’s form is that privileges drop to those of whichever party supplied the content being read.
Human in the loop: a person confirms consequential actions before they happen.
Egress control: restricting where rendered content may load from and stripping or redacting URLs in output.
Dual LLM pattern: Willison’s 2023 design in which a privileged model with tools never sees untrusted text and a quarantined model that reads it can do nothing else.
CaMeL: a 2025 design from Google DeepMind and ETH Zürich that extracts a task’s control and data flow from the trusted request and attaches capabilities to data so policy can refuse unsafe tool calls.
Spotlighting: Microsoft researchers’ 2024 techniques for marking where untrusted content begins and ends so the model can weigh provenance; a strong filter rather than a boundary.
Classifier: a model trained to recognise injected instructions in inputs; useful as a layer, evadable by phrasing.
Security boundary: a control that holds regardless of what the injected text says. Detection is not one; least privilege, confirmation and egress control are.

Evaluation terms used on this site

Words that describe how the scanner reports and how it is measured.

Indicator: a passage that matched a versioned rule combining an instruction, a target and an objective, reported with its channel and location for review.
Finding versus verdict: a finding says a passage deserves a look; it never says an attack is present, because the trust role of a document is not visible in its text.
Hard negative: a document that resembles an attack but is not one, such as a security policy quoting an attack; kept in the evaluation set so the scanner stays usable.
False positive: an indicator raised on a hard negative.
Coverage: the report of which layers of a document were inspected, partially inspected or unavailable. A clean result over partial coverage is a weaker claim than one over complete coverage.
Review aid: what this scanner is. It supports a person’s decision about untrusted text and replaces none of the controls above.

Primary references

These sources describe the external risks or standards discussed above. The property’s detector claims remain limited to its versioned policy and recorded evidence.

Browse every guide

Result boundary: Findings are indicators for review. Detection cannot certify a source, and a no-indicator result does not replace downstream isolation, validation, least privilege or approval.

Start a private scan Review limitations