Prompt Injection Is the New SQL Injection

When I first started shipping LLM features into production, I kept reaching for the same mental model I had built defending web apps from SQL injection. The analogy is imperfect, but useful.

In both cases, untrusted input is concatenated with privileged instructions and handed to an interpreter that cannot tell them apart. The difference is that the LLM "interpreter" is probabilistic, and our usual escape hatches — parameterized queries, strict grammars — do not apply cleanly.

What carries over

Defense in depth still works. Treat every model output as untrusted. Scope tools narrowly. Log everything. Assume the attacker will find the system prompt.

What is genuinely new

Indirect prompt injection — where a model reads attacker-controlled content from a webpage, a PDF, a calendar invite — has no analog in the classic OWASP top ten. The attack surface is whatever your retrieval pipeline touches.