Free tools Windows power users keep installed
One-click scans. No signup required.
Under Simon Willison’s definition, an attack is prompt injection only when an application joins untrusted text to a trusted developer prompt before sending both to a language model. If an attacker tries to get a standalone model to ignore its own safety behaviour, Willison classes that as jailbreaking. The distinction matters because the defenses you control sit in different places: in how your application builds its prompts and what it is allowed to do, or in how the model itself is trained to refuse.
The practical question behind the test is simple: did untrusted input get glued into a prompt your developer wrote? If the answer is no, Willison’s usage does not call it prompt injection. The rest of this article explains why that test exists, where other security frameworks draw the line differently, and how to apply it during a design review.
As an Amazon Associate I earn from qualifying purchases.
The test in Willison’s own words
Simon Willison’s article Prompt injection and jailbreaking are not the same thing, published March 5, 2024, defines prompt injection as an attack on applications built on large language models. The attack works by concatenating untrusted user input with a trusted developer prompt. Willison deliberately ties the name to SQL injection, where data is mixed into a command string and the database cannot tell the data from the command.
The sentence that makes the test usable is this: “Crucially: if there’s no concatenation of trusted and untrusted strings, it’s not prompt injection.”
#1 Best Overall
Two things follow from that sentence. First, the term describes a property of an application’s architecture, not a property of a particular malicious message. The same words can be a prompt injection in one product and harmless in another, depending on whether they reach the model alongside trusted instructions. Second, the test is about where the text enters the model’s context, so it can be checked by reading code and data flows rather than by guessing at attacker intent.
Two categories, two different targets
Willison’s framing separates two things that are often lumped together under the phrase “AI attacks.” The table below sets out the distinction using his definitions.
| Dimension | Prompt injection | Jailbreaking |
|---|---|---|
| What is attacked | An application built on an LLM, which combines trusted developer instructions with other input | The model’s built-in safety filters |
| Where the hostile content enters | Untrusted content (a user message, document, email or web page) joined to a trusted application prompt | An attempt to override the model’s safeguards, with no application-level concatenation required by the definition |
| What the attacker typically gains | Influence over the application’s behaviour, including access to data or tools the application can use | Output the model’s safety behaviour would normally withhold |
| Whether the application’s permissions matter | Yes, Willison ties severity to what the application can reach | Not part of Willison’s definition |
The table shows the categories as Willison defines them. In real systems they can meet. Willison notes that some jailbreaks use prompt injection, and that defenses built against prompt injection can be broken by jailbreak techniques. A single attack can therefore be both, which is why the test is a way of reasoning about a system rather than a rule for sorting incidents into bins.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →What concatenation looks like in practice
Consider two cases that look similar from the outside.
- A standalone chat model. A user writes a long role-play prompt designed to get the model to produce content its refusals would normally block. There is no developer prompt being combined with third-party content and no application data or tools in play. Under Willison’s usage, this is jailbreaking.
- An application that summarises web pages. The developer’s code fetches a page, pastes its text into a prompt that begins with “Summarise the following for the user,” and sends the result to the model. If the page contains a sentence telling the model to ignore the summary instruction and do something else, the untrusted page text and the trusted instruction now share one context. Under Willison’s test, this is prompt injection.
The second case is where the concatenation test does its work. The question is not whether the text is malicious, since a page author has no obligation to behave, but whether your code put that text into the same prompt as your instructions. Retrieval-augmented search, email assistants, document Q&A tools and browsing agents all do this by design, which is why they are the usual setting for prompt injection concerns.
Why the application’s powers decide severity
Willison’s second point is that the impact of prompt injection depends on what the application can do. He identifies the most serious case as an application that can access confidential information or use privileged tools to act, such as searching and forwarding email.
Two illustrative versions of the same injected sentence show the difference. In a summariser with no access to anything beyond the page it has just read, a successful injection typically changes the text the user sees. In an assistant that can search a mailbox and forward messages, the same injection could try to make the model retrieve private messages and send them somewhere. The injected text is equally unwelcome in both, but the consequences are not comparable. This is why a design review should list each tool and data source the model can reach, not only the prompt template.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Where other frameworks draw the line differently
Willison’s test is not the only classification in use, and it is worth naming the difference rather than implying that all authorities agree. OWASP’s LLM01:2025 entry on prompt injection, part of its Top 10 for large language model applications, groups attacks by how they arrive: direct prompt injection, where the user’s own input manipulates the model, and indirect prompt injection, where the instructions come from external content the model processes. OWASP also places jailbreaking within prompt injection as a form of it.
| Source | How it organises the topic | Where jailbreaking sits |
|---|---|---|
| Simon Willison, March 5, 2024 | Prompt injection is defined by concatenating untrusted and trusted strings in an application. Jailbreaking is an attack on the model’s safety filters. | A separate category from prompt injection |
| OWASP, LLM01:2025 Prompt Injection | Direct and indirect prompt injection, described by the route the malicious instructions take | A form of prompt injection |
The OWASP Top 10 page identifies the 2025 list as the current version at the time of the material reviewed for this article. Taxonomies in this area are still forming, so a writer or engineer should state which framework is being used when a term carries weight, such as in an incident report or a compliance document.
Mitigation is layered, not a guarantee
OWASP’s 2025 guidance is direct about the limits of prevention. It states: “Given the stochastic influence at the heart of the way models work, it is unclear if there are fool-proof methods of prevention for prompt injection.” The practical response is a set of layers that reduce the chance and impact of a successful attack.
- Separate and identify external content. Keep untrusted text clearly marked as data, not instructions, in the prompt structure.
- Apply least privilege. Give the model only the data access and tools a task requires, so a successful injection has less to reach.
- Require human approval for high-risk operations. Sending messages, deleting records and making payments are the actions where an injected instruction does the most damage.
- Test adversarially and repeat the test. Attempt the attacks you expect, and re-run them after prompt, model or tool changes.
Delimiters, careful system-prompt wording and injection detectors belong in the same toolkit. None of them should be treated as a complete solution, because each can be bypassed and none changes the underlying fact that the model reads all of its context as text.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsA design-review checklist for the test
- List every string that enters the model’s context. Include system prompts, user messages, retrieved documents, tool outputs, email bodies and fetched web pages.
- Mark each string as trusted or untrusted. Developer-written instructions are trusted. Anything a user, third party or external system can write is untrusted.
- Check for a join. If untrusted text and trusted instructions share one prompt, record the path as prompt injection exposure under Willison’s test.
- Map the consequences. For each exposed path, list the data the model can read and the tools it can call. This sets the severity more than the attack label does.
- Apply the layers above to each exposed path. Prioritise paths where untrusted input can reach private data or actions that change state.
- Classify the remaining attacks as jailbreaks if they only try to get past the model’s refusals. Then decide whether that output can cause harm in your product, which is a separate question from the label.
What the test does not settle
The concatenation test clarifies terminology and points to the parts of a system that need controls. It does not measure how often attacks succeed, and the sources reviewed here do not supply a reliable prevalence or success-rate figure for either category. It also does not say which framework a regulator or customer will use, so the safest course is to name the taxonomy you are applying and to describe the data flow in plain terms, whichever label you choose.
Willison’s sentence remains the most useful single test for developers because it turns a vague worry into a question with a yes or no answer: does your application put untrusted text and trusted instructions into the same prompt?
”
Frequently Asked Questions
Does calling something a jailbreak rather than prompt injection make it less serious?
Not necessarily. Willison’s label describes the attack path, not the harm. A jailbreak that produces output your product should never show can still matter, so judge the consequence of the output in your own context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
