TL;DR: Prompt injection is when text inside a model’s input gets treated as instructions the model then follows. For API teams it shows up in two directions: your API gets called by an LLM or agent, and your API returns data that an LLM later reads. Indirect injection hides instructions inside ordinary response fields, and a credentialed agent can be talked into misusing the very APIs it is allowed to call, which is the confused-deputy problem. You cannot fix this at the model from your side. You can shrink the blast radius: treat every model output as untrusted, and never let raw model output drive a privileged API call without independent validation and authorization. This guide shows how to test that boundary, including with mocked adversarial payloads.
Your API used to be called by browsers, mobile apps, and other services. Now it is also called by language models and the agents built on them, and its responses are increasingly read by a model instead of a person. That shift changes your threat model. Prompt injection is the failure mode at the center of it, and it tops the OWASP Top 10 for large language model applications as risk LLM01.
Try Apidog today
This guide is for people who build and operate APIs, not machine learning researchers. You need to understand where your API sits in an agent loop and what your endpoints must refuse to do.
