All Prompting is Prompt Injection

Translated from the Spanish original with AI assistance. The original was written entirely by hand, no AI involved.

There is no such thing as “Prompt Injection” as an attack mechanism, nor as a vulnerability. It does not exist because every prompt is “injected” into the “flat” context of an LLM, a token space where by design every token has the same “privileges” as any other token, and tokens do not distinguish between instructions and data.

Your instructions to the LLM are data, the data your users enter and that you pass to the LLM are instructions.

This post is a condensed version of the one by Garrett Galloway, which I loved when I read it — and if your first instinct is to argue back with OWASP LLM01:2025, then I failed to get the point across.