The short answer#
| Jailbreak | Prompt injection | |
|---|---|---|
| Target | The model's safety training and content policy | The application's instructions and trust boundary |
| Typical attacker | The user, attacking their own session | A third party, attacking someone else's session (indirect), or the user exceeding their authority (direct) |
| Goal | Get content the model would normally refuse | Make the system do something its operator didn't intend: leak data, call tools, change behaviour |
| Who is harmed | Mainly third parties and the provider (misuse) | The user, the operator, their data and systems |
| Primary defence | Model safety training, output classifiers | Architecture: least privilege, provenance, tool-call policy |
| OWASP LLM 2025 | Treated as a form of LLM01 | LLM01 Prompt Injection |
Jailbreaks in more detail#
A jailbreak is input crafted to make a model produce output its developer trained it to refuse. Known families include role-play framings, many-shot prompting with fabricated compliant examples, encoding and translation tricks, multi-turn escalation such as Crescendo [2], and optimised adversarial suffixes found by gradient search, which Zou et al. showed can transfer between models [1].
The harm model is misuse: the person typing is the one who benefits. In a consumer chatbot that is a provider-level policy problem. In an enterprise application with no tools, a jailbreak mostly produces embarrassing or non-compliant text: a reputational and compliance risk, but bounded.
Prompt injection in more detail#
Prompt injection subverts the application layer. The operator's system prompt and tool design say what the system should do; injected text tries to override that. Its harm model is compromise: someone other than the operator gains control of the system's behaviour, including its tools. When the payload arrives through retrieved content (indirect injection), the person harmed is the innocent user whose session executes it.
Where they overlap#
Overlap is real. An injected payload often uses jailbreak techniques to make the model comply, and a jailbreak typed into an agent with tools becomes an injection if it gets the agent to act outside the operator's intent. The useful test is to ask two questions:
- Whose intent is being violated? The model developer's content policy (jailbreak) or the application operator's instructions and permissions (injection)?
- Who is the attacker relative to the session? The user themself, or a third party whose content entered the session?
If the answers are "operator" and "third party", you are dealing with the dangerous case, whatever technique the payload uses.
Why the distinction changes the defence#
Treating injection as a jailbreak problem leads teams to rely on the model's refusal behaviour and content classifiers. Those help against harmful text, but an injected instruction to "forward the last invoice to this address" contains nothing harmful as text. It is a well-formed business request. Only architecture stops it: tool permissions, provenance rules and deterministic policy on actions. Conversely, treating jailbreaks as an injection problem leads to over-engineering tool controls in a system whose real risk is generating regulated advice.
Test them separately: a jailbreak suite scored by harmful-compliance graders, and an injection suite scored by action assertions such as "no email sent to unlisted recipients" and "no tool call triggered by retrieved content".
Frequently asked questions#
Is a jailbreak a type of prompt injection?
They overlap but aren't the same. OWASP groups jailbreaking under LLM01 Prompt Injection, yet the threat models differ: jailbreaks target model safety training and are usually performed by the user, while prompt injection targets the application's instructions and is often performed by a third party through content the system reads.
Which is more dangerous for AI agents?
Prompt injection, especially indirect injection, because it lets an outsider trigger the agent's tools using the legitimate user's permissions.
Sources#
- A. Zou et al. Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv:2307.15043, 2023. arxiv.org
- M. Russinovich, A. Salem, R. Eldan. The Crescendo Multi-Turn LLM Jailbreak Attack. arXiv:2404.01833, 2024. arxiv.org
- OWASP GenAI Security Project. OWASP Top 10 for LLM Applications 2025, released November 2024. genai.owasp.org