--- title: What is Prompt Injection? | daily.dev description: Prompt injection is the top-ranked risk for LLM-driven applications, according to the OWASP Top 10 for LLM Applications 2026 guide. It splits into direct... canonical: https://daily.dev/posts/what-is-prompt-injection--wl3iyorm9 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: What is Prompt Injection? | daily.dev og:description: Prompt injection is the top-ranked risk for LLM-driven applications, according to the OWASP Top 10 for LLM Applications 2026 guide. It splits into direct... og:url: https://daily.dev/posts/what-is-prompt-injection--wl3iyorm9 og:image: https://api.daily.dev/og/posts/wL3iYoRM9.png og:image:alt: What is Prompt Injection? og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # What is Prompt Injection? **[Nordic APIs](https://daily.dev/sources/nordicapis)** · 11 min read · 1 upvotes · 0 comments ## Summary Prompt injection is the top-ranked risk for LLM-driven applications, according to the OWASP Top 10 for LLM Applications 2026 guide. It splits into direct injection, where a user embeds malicious text in a prompt, and indirect injection, where instructions hide in external content like PDFs or images. Google researchers observed an increase of 32% in the malicious prompt injection category on the public web between November 2025 and February 2026. New techniques include 'Ghostcommit', a proof-of-concept that hides instructions in PNG images in pull requests, and 'BioShocking', which manipulates AI browsers. APIs widen the attack surface, since every tool with an API integration is a new place where an attacker can plant instructions, and over-permissioned agents can misuse the permissions they carry. Defenses include input filtering, output validation, rate limiting, and continuous monitoring. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What's the difference between direct and indirect prompt injection? Direct prompt injection happens when a user places malicious text straight into a prompt they submit to an AI model. Indirect prompt injection (IPI) occurs when malicious instructions are hidden in external content, such as a PDF, image, or API response, that the model later reads and processes. If a user uploads an injected PDF via a direct prompt, that still counts as indirect injection because the malicious instructions live in the external file. _Teams hardening LLM apps against injection attacks can track emerging techniques on daily.dev._ ### How do APIs increase the attack surface for prompt injection in AI agents? APIs expand the attack surface on two levels: the APIs developers use to integrate LLMs, and the APIs that LLMs call as tools. An AI agent with no tool access has only one injection vector, the user's direct prompts. Once wired to APIs through tool calling, it consumes API responses that may contain hidden instructions, and it carries authentication tokens whose permissions an injected instruction can misuse. _Architects weighing how much API access to grant AI agents can follow this risk on daily.dev._ ### What is the Ghostcommit prompt injection attack? Ghostcommit is a proof-of-concept indirect prompt injection attack aimed at GitHub that hides malicious instructions inside a PNG image included in a pull request, with the goal of stealing a repository's secrets. Because the injected text sits inside the image rather than visible text, a human reviewer checking the pull request is unlikely to notice it. _Developers reviewing AI-assisted pull requests can keep up with attacks like this on daily.dev._ ## Similar posts on daily.dev - [Prompt Injection Is the New SQL Injection \(and We're Not Ready\)](https://daily.dev/posts/prompt-injection-is-the-new-sql-injection-and-we-re-not-ready--3vjyussdp) · DEV · 4 upvotes · 0 comments - [Best of 2025: Indirect prompt injection attacks target common LLM data sources](https://daily.dev/posts/best-of-2025-indirect-prompt-injection-attacks-target-common-llm-data-sources-xluj6u2z5) · Security Boulevard · 1 upvotes · 0 comments - [Hiding Prompts in Plain Sight: A New AI Security Risk](https://daily.dev/posts/hiding-prompts-in-plain-sight-a-new-ai-security-risk-mzblzfejg) · Auth0 · 1 upvotes · 0 comments - [Prompt Injection Defense 2026: AI App Security Guide](https://daily.dev/posts/prompt-injection-defense-2026-ai-app-security-guide-er326qdep) · Alex CloudStar · 0 upvotes · 0 comments - [Indirect Prompt Injection remains a fundamental security challenge for AI](https://daily.dev/posts/indirect-prompt-injection-remains-a-fundamental-security-challenge-for-ai-xnrdac9em) · Brave · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/what-is-prompt-injection--wl3iyorm9) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"What is Prompt Injection?","url":"https://daily.dev/posts/what-is-prompt-injection--wl3iyorm9","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/what-is-prompt-injection--wl3iyorm9"},"datePublished":"2026-10-29T18:05:12.195Z","dateModified":"2026-10-29T18:06:27.355Z","description":"Prompt injection is the top-ranked risk for LLM-driven applications, according to the OWASP Top 10 for LLM Applications 2026 guide. It splits into direct...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2a45d432dbae9f1fbd93e663c0bbf74a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/2a45d432dbae9f1fbd93e663c0bbf74a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Nordic APIs","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Nordic APIs","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/957e9f265c5d475b89d078b558157031","url":"https://daily.dev/sources/nordicapis"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/what-is-prompt-injection--wl3iyorm9","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,ai-agents,prompt-injection","timeRequired":"PT11M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Nordic APIs","item":"https://daily.dev/sources/nordicapis"},{"@type":"ListItem","position":3,"name":"What is Prompt Injection?"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/what-is-prompt-injection--wl3iyorm9#faq","mainEntity":[{"@type":"Question","name":"What's the difference between direct and indirect prompt injection?","acceptedAnswer":{"@type":"Answer","text":"Direct prompt injection happens when a user places malicious text straight into a prompt they submit to an AI model. Indirect prompt injection (IPI) occurs when malicious instructions are hidden in external content, such as a PDF, image, or API response, that the model later reads and processes. If a user uploads an injected PDF via a direct prompt, that still counts as indirect injection because the malicious instructions live in the external file. Teams hardening LLM apps against injection attacks can track emerging techniques on daily.dev."}},{"@type":"Question","name":"How do APIs increase the attack surface for prompt injection in AI agents?","acceptedAnswer":{"@type":"Answer","text":"APIs expand the attack surface on two levels: the APIs developers use to integrate LLMs, and the APIs that LLMs call as tools. An AI agent with no tool access has only one injection vector, the user's direct prompts. Once wired to APIs through tool calling, it consumes API responses that may contain hidden instructions, and it carries authentication tokens whose permissions an injected instruction can misuse. Architects weighing how much API access to grant AI agents can follow this risk on daily.dev."}},{"@type":"Question","name":"What is the Ghostcommit prompt injection attack?","acceptedAnswer":{"@type":"Answer","text":"Ghostcommit is a proof-of-concept indirect prompt injection attack aimed at GitHub that hides malicious instructions inside a PNG image included in a pull request, with the goal of stealing a repository's secrets. Because the injected text sits inside the image rather than visible text, a human reviewer checking the pull request is unlikely to notice it. Developers reviewing AI-assisted pull requests can keep up with attacks like this on daily.dev."}}]} ```