A cloud-hosted support chatbot built on a large language model summarizes documents that customers upload. A tester uploads a file containing hidden text that tells the model to ignore its rules and include a phishing link in its reply, and the chatbot complies. Which OWASP Top 10 for LLM Applications risk does this demonstrate?

Prompt injection occurs when input causes a large language model to deviate from its intended instructions. Direct injection comes from the user's own prompt; indirect injection, as here, arrives through external content the model processes, such as an uploaded document, web page or email, where hidden or embedded instructions are interpreted as commands. The chatbot obeyed text in the file because language models do not reliably separate data from instructions. Mitigations include treating retrieved content as untrusted, segregating it from instructions, validating outputs such as links before delivery, and requiring human approval for sensitive actions. Data and Model Poisoning refers to manipulating pre-training, fine-tuning or embedding data so that the model itself learns malicious or biased behavior; the uploaded file affected only one inference, not the model. Excessive Agency describes granting a model-based system too much functionality, permission or autonomy to act on other systems; the chatbot produced text and took no external action. Sensitive Information Disclosure concerns the model revealing confidential data such as personal information or proprietary details, whereas the harm here is attacker-controlled content inserted into the response. Exam caveat: no single control eliminates prompt injection, so layered defenses are expected. Operational check: run injection test cases embedded in uploaded files and confirm outputs are filtered before delivery.