Skip to content
Module
Module 2 of 6Lesson 2 of 2~19 min

Direct and indirect prompt injection, and system prompt leakage

Prompt injection is still an open problem, even for the major model providers. This lesson helps you tell its different forms apart, list every place where it can get into your product and decide what does and does not belong in a system prompt, given that it may one day be exposed.

Take this lesson: your first course is freeSee the full syllabus

Lesson objective

By the end of this lesson, you will be able to tell direct injection, indirect injection and jailbreaks apart, list every injection entry point in your product, and decide what may or may not go into a system prompt.

Topics covered

  • prompt injection
  • indirect prompt injection
  • jailbreak
  • system prompt

In the glossary

Full glossary

Where it fits

Map the threats

Where can an AI product be attacked, and how do you prioritize what you protect?

Lessons in this module

  1. Map the threats with OWASP and keep a risk register
  2. Direct and indirect prompt injection, and system prompt leakage (this lesson)

What you will learn in this module

This lesson is part of the course Secure an AI product: prompt injection, guardrails and the AI Act

  • Map the attack surface of an AI product and its risks with the OWASP Top 10 for LLM Applications 2025, in a prioritized risk register.
  • Analyze a product's direct and indirect prompt injection paths, system prompt leakage and data exfiltration (lethal trifecta).

Related courses