Prompt Injection Risk Assessment

Prompt injection is an input that makes a language model ignore or change the instructions its developer gave it. Direct injection comes from the person typing. Indirect injection is hidden in content the system reads, such as a document, web page, email or tool result. OWASP lists it first (LLM01) in its Top 10 for LLM Applications.

The assessment combines three things: exposure (who and what can put text in front of the model), impact (what the system can do and see if it is manipulated), and controls (the safeguards you already have). Exposure and impact raise the score; controls lower it. The result is a guide for prioritising work, not a security audit.

A chatbot that is manipulated can only say something wrong. An agent that can send email, update records, run code or call payment APIs can turn an injected instruction into a real action. OWASP calls this excessive agency (LLM06). Limiting what each tool can do is one of the most effective controls.

Not with current models. Classifiers and filters catch many attempts but miss some and flag some harmless inputs. That is why the recommended approach combines detection with least-privilege design, human approval for risky actions, and monitoring that shows what happened after a suspicious input.

Start with the recommendations at the top of your results, which target your weakest controls. Usually that means reducing tool permissions, requiring approval for high-impact actions, separating untrusted content from instructions, and adding monitoring so attempts are visible. Then test again with deliberate attacks.

No. Your answers are scored in your browser and are not submitted to Perimattic. Standard page analytics record that the assessment was used, without your answers.