Temprl Labs presents
Security · explainer
Prompt injection vs jailbreaks
The two terms are often used interchangeably. They describe different attacks with different victims, and an agent needs a check for each.
Side by side
| Jailbreak | Prompt injection | |
|---|---|---|
| Goal | Get the model to do what its rules forbid | Make content act as instructions |
| Who attacks | Usually the user | Often a third party, inside content |
| Who is harmed | The developer’s policy, other people | The user, the developer, anyone the agent can reach |
| Typical form | Role-play, hypotheticals, encodings, pressure | Hidden commands, fake authority, task hijacks |
| Where to check | The input | The input, and every tool call it could lead to |
Where they overlap
An injected document can contain a jailbreak, and a jailbreaking user can inject instructions. What matters for defence is the same question: is this text trying to change what the agent does, beyond what the policy and the user’s goal allow?
Checking for both
Simo Guard has a preset for each, injection and jailbreak, and a category check that sorts each step into benign, injection, jailbreak or exfiltration, useful as a log-only signal for dashboards. Because every check is a question in the same read, running all of them costs little more than one.
Frequently asked questions
Which is more dangerous for agents?
Indirect prompt injection, because it needs no cooperation from the user and arrives through the content agents are built to read.