Simon Willison coins the term 'prompt injection'

Developer Simon Willison wrote up and named a vulnerability that Riley Goodside had demonstrated against GPT-3 the day before: feeding a model a prompt containing untrusted text — a user’s message, a document, a web page — could let that text override the instructions the application’s developer had intended the model to follow. Goodside had shown, for instance, that an automated-translation prompt could be hijacked by embedding an instruction inside the text to be translated, causing the model to ignore the translation task entirely and follow the embedded instruction instead.

This isn’t just an interesting academic trick: it’s a form of security exploit. I propose that the obvious name for this should be prompt injection.

— Simon Willison, “Prompt injection attacks against GPT-3”

Willison drew the comparison directly to SQL injection — the decades-old class of vulnerability where unsanitised user input, concatenated into a database query, can be crafted to run as code rather than data. The parallel was structural: any system that mixes trusted instructions and untrusted content in the same channel (a single text prompt, in the case of a language model) has no reliable way to keep the two apart, and no patch fixes it the way input sanitisation fixes SQL injection, because the model’s only way of following instructions at all is by reading text.

At the time this was a curiosity about GPT-3 completions, with no fix proposed and no clear attack surface beyond novelty demos. It became far more consequential once language models began acting as agents — browsing web pages, reading emails, calling tools — because any of that untrusted external content could now carry an injected instruction the model might act on. Prompt injection remained, three years on, one of the field’s most-cited unsolved security problems, and Willison continued writing and cataloguing real-world instances of it through the agentic era that followed.