Prompt security is the practice of protecting the instructions, inputs, and outputs that flow through AI systems—especially large language models—from manipulation, theft, or misuse. It covers blocking malicious instructions and protecting the prompts themselves as intellectual property.
Key takeaways
- Prompt security protects the instructions, inputs, and outputs flowing through AI systems from manipulation and theft.
- It covers two core risks: prompt injection, which hijacks the model’s behavior, and prompt poaching, which steals your prompt engineering.
- Large language models can’t always tell trusted instructions apart from text that just looks like instructions, and that’s the root of most prompt security problems.
- Expel runs dedicated threat hunts focused on AI and agentic risk, including prompt-level attacks.
- Prompt security works best folded into your existing AI risk review process, not treated as a separate project.
If your team is rolling out AI in cybersecurity to move faster, prompt security is the piece you can’t skip. Large language models (LLMs) take instructions as plain text, and that’s exactly the problem. Any text can carry instructions, whether it’s typed by a user, hidden in a document, or buried in a support ticket. Prompt security is the set of practices, controls, and threat hunts that keep those instructions from being hijacked or your prompts from being stolen. It’s a foundational layer of any broader AI risk program.
What is prompt security?
Prompt security is the discipline of protecting the text that controls how an AI system behaves. That includes the system prompts your team writes, the user inputs the model processes, and the outputs it generates in response.
Here’s the thing that makes this hard: LLMs don’t have a built-in way to tell “trusted instructions” apart from “text that just happens to look like instructions.” A model reading a résumé, a support ticket, or a webpage can’t always separate legitimate content from a hidden command planted by a bad actor.
Prompt security isn’t one control or one tool. It’s a combination of how you design your prompts, how you validate inputs and outputs, how you limit what a model or agent is allowed to do, and how you monitor for signs that something’s already gone wrong.
Why prompt security is its own discipline now
A few years ago, “AI security” mostly meant securing the infrastructure a model ran on—the servers, the APIs, the data pipelines. That’s still necessary, but it’s not enough anymore.
Once companies started putting LLMs in front of customers, embedding them in internal tools, and connecting them to agents that can take real actions, the prompt itself became an attack surface. A cleverly worded instruction, slipped into a chatbot conversation or a document an AI agent reads, can steer the model somewhere it was never supposed to go.
That shift is why prompt security has become its own discipline instead of a subset of general AI security.
The two core prompt security risks
Most prompt security problems fall into one of two buckets: someone is trying to manipulate what the model does, or someone is trying to steal how you got the model to do it well.
| Prompt injection | Prompt poaching | |
|---|---|---|
|
Attacker’s goal |
Hijack the model’s behavior | Steal your prompt engineering |
|
What’s targeted |
The AI system’s instructions | Your proprietary IP |
|
Typical result |
The model does something it shouldn’t | A competitor or bad actor gets a free copy of your work |
We cover each one in full on its own page. Here’s the short version of both.
Prompt injection
Prompt injection is when a bad actor sneaks malicious instructions into a model’s input to override its intended behavior through a direct message, a hidden line in a document, or content the model pulls from the web..
Prompt poaching
Prompt poaching is when someone extracts or reverse-engineers your carefully tuned prompts and copies or repurposes them without permission.
How prompt security fits into a broader AI risk program
Prompt security is one layer in a wider AI risk program that also covers model access controls, data governance, third-party AI tool vetting, and monitoring for misuse across every system that touches an LLM.
The teams that get this right build prompt security into the same review process they already use for AI risk generally, including threat modeling new AI features, testing agentic workflows before launch, and treating prompts with the same scrutiny they’d give to code.
How Expel’s threat hunts cover prompt security
Most vendors will tell you they “cover AI risk” without saying what that actually means day to day. Here’s what it means for us.
Expel runs four dedicated threat hunts built specifically for AI and agentic risk. These hunts look for the behavioral signals of prompt injection attempts hitting production systems, unusual patterns in LLM API calls, signs that an AI agent is chaining actions in ways it shouldn’t, and attempts to extract or exfiltrate proprietary prompts and model configurations.
This is human-led and AI-powered analysis working together. Our analysts define what “bad” looks like in an AI context, and our tooling helps them find it faster.
Prompt security best practices for teams building on AI
- Treat every prompt as untrusted input until it’s validated.
- Separate system instructions from user input wherever your architecture allows it.
- Limit what agents and models are allowed to do by default, and require explicit approval for higher-risk actions.
- Log and monitor model inputs and outputs, not just infrastructure metrics.
- Protect your prompt engineering the same way you’d protect other IP.
- Build prompt security into existing AI risk reviews instead of treating it as a one-off project.
Frequently asked questions
What is prompt security in simple terms?
Prompt security is protecting the instructions and text that control how an AI system behaves, guarding against attackers who try to manipulate what a model does and against anyone trying to steal the prompts your team worked hard to refine.
What’s the difference between prompt injection and prompt poaching?
Prompt injection is about manipulation—an attacker sneaks instructions into a model’s input. Prompt poaching is about theft—someone extracts or copies your proprietary prompt engineering.
Why does prompt security matter for businesses building on AI?
A single manipulated prompt can expose data, trigger unintended actions, or hand a competitor your prompt engineering for free. As more companies connect large language models to real workflows, the blast radius of a prompt-level failure grows.
Does MDR cover prompt security risks?
Yes, when the managed detection and response (MDR) provider has built AI-specific detections into its program. Expel’s threat hunting includes four dedicated hunts for AI and agentic risk.
How do I start securing my prompts?
Start by treating every prompt as untrusted input and separating system instructions from user-supplied content. From there, add monitoring, limit what your agents can do without approval, and fold prompt security into your existing AI risk review process.