A foundational security principle is the boundary between code (the instructions a developer wrote) and data (the values a user supplied). Classic injection attacks all arise when attacker-controlled data crosses that line and gets interpreted as instructions — an idea you will encounter throughout this course.
A large language model erases that boundary by design. The developer's system instructions, the user's message, and any document the application retrieved are all handed to the model as a single stream of natural-language text. The model has no reliable built-in way to know which words it should obey and which it should merely read. There is no parameterized-query equivalent inside a prompt.
That is why an LLM application — anything that builds a prompt from data, sends it to a model, and then acts on the response — is a genuinely new attack surface, and why prompt injection is not simply "cross-site scripting for chatbots". It is a structural property of how today's models work, not a single bug a patch removes.
Prerequisites: input-validation-output-encoding for safe sink handling, api-security for tool/API authorization, and hacking-ethics-and-authorization for scope. The course tutor and third-party assistants are not lab targets; use only an endpoint you own or are explicitly authorized to test.
In this lesson you will:
- See why instructions and data sharing one channel makes prompt injection unavoidable in principle.
- Meet the four risks a beginner most needs from the OWASP Top 10 for LLM Applications: prompt injection, insecure output handling, sensitive-information disclosure, and excessive agency.
- Write a direct prompt-injection phrase and try it against an endpoint you are authorized to test.
- Reason about the two durable defenses — treating model output as untrusted and granting the model least privilege — and why they generalize the rest of the course.
Estimated time: 10 to 15 minutes.
When you are ready, send the Continue signal.