Prompt injection vs jailbreaks
Last reviewed: August 30, 2026 · Editor: Prompt Injection Check
The terms are related but describe different targets. Understanding the distinction helps teams choose the right controls.
| Prompt injection | Jailbreak | |
|---|---|---|
| Target | A model-powered workflow, agent, or tool connection. | A model’s safety behavior or refusal boundaries. |
| Source | Often untrusted external content such as an email or webpage. | Usually the user’s direct conversation with the model. |
| Goal | Change the task, trigger a tool, or expose data. | Make the model produce content it should refuse. |
Why the distinction matters
A jailbreak may be harmful even when no tools are connected. Prompt injection becomes especially dangerous when the assistant can access private data or take external actions. In an agent workflow, a harmless-looking document can be the attack vehicle.
Shared defenses
Use clear instruction boundaries, least-privilege access, output validation, rate limits, monitoring, and human approval for high-impact actions. A text scanner can highlight injection language, but it does not test a model’s refusal behavior.