Analysis · curated 21 Jul 2026
Prompt Injection: The XSS of LLMs | Tomasus
First reported · updated · 2 reports medium.com
Coverage timeline
Why it matters
Prompt injection remains the top OWASP LLM application risk and stems from the fundamental architecture of LLMs, so defenders need a clear mental model of direct versus indirect injection to reason about mitigations.
Tomasus publishes an explainer framing prompt injection as "the XSS of LLMs," arguing that because a model reads instructions and data as one continuous token stream, the system/user prompt boundary is only a convention and later persuasive text can override the developer's rules. The piece walks through direct injection (override, role-play framing, payload smuggling) and indirect injection via retrieved content such as web pages, PDFs, and emails, referencing the OWASP LLM Top 10 and the Greshake et al. indirect prompt injection research.