A public support chatbot receives the message I need help resetting my password, retrieves the account-help article, and returns the approved reset steps. Its safe behavior depends on more than the response text. The application also holds system instructions, retrieved documents, optional account tools, user data, and logs. A jailbreak is an attempt to make the model violate its safety rules or intended behavioral limits through its input. In this chatbot, the attempt originates in user input and targets the model’s safety behavior.
The immediate risk might be an unsafe reply, but the larger risk appears when the reply influences another component. If the model can call lookup_order, an altered output could request data outside the user’s account. If the model only produces text and the application verifies every action in code, the same failed behavior has a smaller impact. We therefore trace both where untrusted content enters and what the surrounding application lets model output reach. Look at the trust boundaries in this support-chat flow:
The chatbot pipeline shows why jailbreaking is part of a broader input problem. A prompt injection occurs when content alters model behavior in a way the application developer did not intend. Current language models process system instructions, user messages, retrieved passages, and tool results in a shared token context. Labels such as USER_DATA can clarify intent, but they do not create an enforced security boundary.
Jailbreaking is the subset of direct prompt injection that aims to bypass the model’s safety protocols. Direct injection arrives in the user’s message, such as a request that conflicts with the support role. Indirect injection arrives through content the model reads, such as a retrieved help article containing an instruction-shaped sentence. In both cases, the target is altered model behavior. The delivery source determines where we must apply controls.
OWASP identifies this category as LLM01:2026 Prompt Injection. It distinguishes the input-side failure from sensitive-information disclosure, which concerns what leaves in an output, and excessive agency, which concerns the consequences of an output reaching privileged actions. For our chatbot, a user message that changes a response is direct injection; a poisoned retrieved article is indirect injection; a direct attempt to defeat safety behavior is also a jailbreak. Compare the source, target, and containment options next: