Direct prompt injection

Here the person interacting with the model is the adversary. They craft input designed to override the system prompt or safety training — role-play framings, encoded instructions, "developer mode" claims — to make the model produce something it was configured to refuse. Jailbreaking is the common name for this when the goal is disallowed content.

Why it matters

For a single-user assistant, direct injection mostly risks policy violations. It becomes serious when the model has tools and elevated access the user should not fully control, or when one user's session can affect shared state or other users. The defense is to not rely on the model's own refusals as a security boundary.