How does prompt injection in an agent differ from injection in a chat interface, and why is it OWASP LLM Top-10 #1?

**Prompt injection** is when text the model reads tricks it into following instructions from untrusted content instead of your real orders. In a plain chat app, the worst case is a bad answer or a leaked piece of context. The model can only talk, so the damage stays inside the conversation. An agent is different because it has tools. It can write files, send email, run code, or call paid APIs. So when an injection succeeds, it does not just change words. It can fire real tool calls that change the world, and some of those actions cannot be undone. The scariest version is indirect injection. The bad instructions are hidden inside content the agent fetches on its own, like a web page or a document. Nobody typed the attack into the chat box. The agent reads the poisoned page and obeys it. Why can we not just block it? Because the model has no reliable way to separate trusted instructions from data it reads. So we defend in depth instead. Treat all tool output as untrusted, give the agent the fewest permissions possible, sandbox risky tools, and make a human approve high impact actions.

**Prompt injection** is when untrusted content steers the model into following embedded instructions instead of the legitimate system prompt. In a chat app, the worst outcome is a wrong or leaky response. In an agent, the blast radius scales with the agent's tool permissions, so the same exploit can delete files, exfiltrate data, or send email. The hardest variant is indirect injection. Malicious instructions hide in content the agent retrieves, such as a web page or a document. They arrive as an observation, the same channel as legitimate data. The model has no reliable way to tell trusted instructions from data, which is why this is unsolved at the model layer today. So defence is layered, not a single filter. Treat every tool and web output as untrusted data, never as instructions. Scope tools to least privilege so a hijack cannot reach high impact actions. Require human approval on irreversible operations. Sandbox code and network access, attach provenance to retrieved content, constrain tool inputs with strict schemas, and monitor traces for anomalies. No single layer is sufficient. The goal is to shrink and contain the blast radius, not to assume any one control makes the agent safe.