Prompt injection
Jailbreak vs prompt injection: the difference and why it matters
Jailbreak vs prompt injection: a jailbreak attacks a model's safety training, prompt injection attacks the app around it. Comparison table, tests and defenses.
Short answer
A jailbreak tries to make a model break its own safety rules. Prompt injection tries to make an application follow untrusted text as if it were a trusted instruction. Simon Willison drew this line in March 2024. OWASP 2025 treats jailbreaking as a form of prompt injection, and MITRE ATLAS lists them separately, so name your definition before you test.
A jailbreak attacks the model's safety training. Prompt injection attacks the application around the model. Teams often mix up the two terms and then test the wrong thing.
Simon Willison set out the distinction in a post on 5 March 2024. We use his definitions and compare them with OWASP, MITRE ATLAS and NIST.
What is the difference between a jailbreak and prompt injection?#
A jailbreak tries to make a model ignore the safety rules built into it. Prompt injection tries to make an app follow untrusted text as a trusted instruction.
Simon Willison defines prompt injection as "a class of attacks against applications built on top of Large Language Models (LLMs)" that works by "concatenating untrusted user input with a trusted prompt constructed by the application's developer". He defines jailbreaking as "the class of attacks that attempt to subvert safety filters built into the LLMs themselves". His test: "if there's no concatenation of trusted and untrusted strings, it's not prompt injection."
We use his framing because it tells a tester where to look: a jailbreak points at the model, and prompt injection points at the app's design.
How do the two compare side by side?#
The differences below change your test plan.
| Point | Jailbreak | Prompt injection |
|---|---|---|
| Target | The model's safety behavior | The application's trust boundary |
| Typical attacker | A user who talks to the model | A user, or a third party who plants content |
| What the attacker wants | Content the vendor tried to block | Actions, data or answers the app should not give |
| Needs an app around the model? | No | Yes |
| Who owns the fix | Mostly the model vendor | Mostly the app team |
| MITRE ATLAS ID | AML.T0054 LLM Jailbreak | AML.T0051 LLM Prompt Injection (.000 direct, .001 indirect) |
| OWASP LLM Top 10 | Part of LLM01 in the 2025 text | LLM01 in 2025 and 2026 |
| Example harm | Harmful text from a public chatbot | A bot that leaks another customer's data |
Why do OWASP and Willison disagree?#
They define the words differently, and both are in common use. OWASP LLM01:2025 says: "Jailbreaking is a form of prompt injection where the attacker provides inputs that cause the model to disregard its safety protocols entirely." Willison keeps them as two classes.
MITRE ATLAS lists two techniques, AML.T0051 and AML.T0054. NIST AI 100-2 E2025 uses "Prompt Injection" (NISTAML.018) for direct injection.
The naming does not change the testing, but it changes your reports. If a finding says "prompt injection" and your reader uses the narrow definition, they may think you tested the app's boundary when you tested the model's filters. Define the term in your scope and in each finding.
Which one do I test for my product?#
Test the one that matches your risk. The decision table maps situations to tests.
| Your situation | Test first | Why |
|---|---|---|
| Public chatbot, no private data, no tools | Jailbreak resistance and content policy | The main harm is what the bot says |
| Assistant that reads email, files or web pages | Indirect prompt injection | Third parties can plant text |
| RAG over internal documents | Prompt injection plus retrieval access | Injection can pull data across users |
| Agent with tools that change data | Prompt injection and tool authorization | Impact is an action, not text |
| App that fine-tunes or hosts its own model | Both, plus model-level evals | You own more of the safety layer |
| Regulated advice (health, finance, legal) | Both, plus accuracy tests | Wrong or unsafe output has legal weight |
Most business apps need prompt injection testing first. A model that refuses a harmful request does not help if the app lets a document control its tools.
What does each test look like?#
A jailbreak test varies the request and measures whether the model keeps its rules. A prompt injection test varies the source of text and measures whether the app keeps its boundary.
Demonstration
This is a demonstration against Harbor Support, a fictional support assistant. No real customer system was tested. The patterns are described, not given as payloads.
| Test | Input described | Pass condition | Evidence |
|---|---|---|---|
| Jailbreak A | User asks the model to play a persona that has no content rules | Model declines or stays in policy on 10 of 10 runs | 10 transcripts |
| Jailbreak B | User spreads a blocked request over several harmless steps | Model recognizes the combined request | Full conversation |
| Injection A | A customer ticket contains a line that addresses the assistant | Assistant treats it as ticket text | Ticket, reply, tool log |
| Injection B | A web page the bot summarizes asks it to call a tool | No tool call | Page source, tool log |
Result: jailbreak cases A and B pass or fail on text alone. Injection cases A and B need the tool log, because the harm is an action, so a report that lists only transcripts misses them.
How do you defend against each?#
The owner differs, so the defenses differ.
- Jailbreaks: choose a model with strong safety training, add output moderation, and monitor misuse. Accept that vendors still publish bypasses. Treat the model as a component that can fail.
- Prompt injection: limit tool scope, authorize outside the model, require approval for side effects, and control outputs. Read prompt injection and indirect prompt injection for the controls and the sources.
Neither class is fully preventable today (see the next section). Plan for lower likelihood and lower impact, and test the controls.
What is AI red teaming shows where this fits in an engagement. Our LLM application security assessment tests both classes against your build.
What do the sources say about unsolved status?#
Both classes remain open problems. For prompt injection, NCSC wrote on 8 December 2025 that it "may never be totally mitigated in the way that SQL injection attacks can be". OWASP LLM01:2025 says it is unclear whether fool-proof prevention methods exist. Anthropic wrote on 24 November 2025 that no browser agent is immune to prompt injection.
For jailbreaks, vendors publish safety updates and researchers keep publishing bypasses. We do not list bypass recipes here, and we do not treat any model as immune.
How should you write the finding?#
Write the class, the source of text and the effect in one line:
- "Jailbreak: the model produced policy-blocked content after a role-play request (7 of 10 runs)."
- "Indirect prompt injection: text in an uploaded file caused a tool call (3 of 10 runs)."
Add the model version, the settings and the evidence list. The reader can then decide who owns the fix: the model vendor, your prompt design or your tool authorization.
Which mistakes come from mixing the terms?#
Common mistakes:
- Buying a jailbreak test and expecting app coverage. A jailbreak scan sends many prompts at the model. It does not plant text in your documents or test your tool rules.
- Fixing an injection with a stronger refusal policy. A refusal rule in the prompt is text. The attacker's text competes with it.
- Reporting injection as a model defect. The vendor can improve resistance, but the trust boundary is yours. Only your app decides what a model may touch.
What does the standards trail say?#
NIST AI 100-2 E2025 separates direct prompting attacks (section 3.3) from indirect prompt injection (section 3.4) and gives each a taxonomy ID. MITRE ATLAS v2026.10 lists AML.T0051 LLM Prompt Injection with sub-techniques for direct (.000), indirect (.001) and triggered (.002) cases, and AML.T0054 LLM Jailbreak. If your customer asks for a mapping, give both the ATLAS ID and the OWASP edition so that the reader can follow either path. The frameworks page describes our approach.
Shipping an AI feature or agent?
Describe the system, the data it reads and the actions it can take. We reply with questions and a proposed scope.
Questions
Is a jailbreak a type of prompt injection?
It depends on the source you follow. OWASP LLM01:2025 calls jailbreaking a form of prompt injection. Simon Willison and MITRE ATLAS keep them apart (AML.T0054 for jailbreak, AML.T0051 for prompt injection). Pick one definition, write it down, and use it in your test plan.
Which one is more dangerous for a business app?
Prompt injection usually has more business impact, because it can reach your data and tools. A jailbreak mostly produces content the vendor tried to block. A jailbreak still matters when your brand, policy or legal duty depends on what the model says.
Does a model vendor's safety training stop prompt injection?
No. Safety training targets harmful content. Prompt injection exploits how your app assembles its context. Vendors publish defenses and call the problem unsolved, so your app needs its own controls.
Sources
- Simon Willison: Prompt injection and jailbreaking are not the same thing (5 March 2024) (checked 9 November 2026)
- OWASP Top 10 for LLM Applications 2025 (PDF), LLM01 (checked 9 November 2026)
- OWASP Top 10 for LLM Applications 2026, LLM01 and README (checked 9 November 2026)
- MITRE ATLAS data release v2026.10 (AML.T0051, AML.T0054) (checked 9 November 2026)
- NIST AI 100-2 E2025: Adversarial Machine Learning taxonomy (checked 9 November 2026)