The full answer
A jailbreak is a user trying to make the model break its own safety rules or the product's content policy: produce harmful content, drop its guidelines. Prompt injection is text, often hidden in content the model reads, that hijacks what the application does: ignore the developer's instructions, misuse tools, leak data. OWASP treats jailbreaking as a form of prompt injection. The defences overlap, but injection needs more than content filters, because the damage comes from the application's tools and data.
Side by side
| Jailbreak | Prompt injection | |
|---|---|---|
| Who attacks | Usually the user typing | The user, or a third party through documents, web pages, emails, tool results |
| Goal | Get content the model would refuse | Make the app do something its owner did not intend |
| Typical harm | Policy-violating text | Data leaks, unauthorised actions, wrong outputs shown to others |
| Example | Role-play to get dangerous instructions | A web page telling a browsing agent to email the user's files |
Defences against jailbreaks
- The model's own safety training (choose models with strong safeguards).
- A harmlessness screen: Anthropic's guide suggests a lightweight model pre-screening input and returning a simple classification through structured output.
- Output classifiers against your content policy.
- Monitoring for repeated attempts, and limits or blocks for abusive users.
Defences against prompt injection
- Everything above helps, but is not enough.
- Separate untrusted content from instructions, clearly marked as data.
- Least privilege: tools that can do little damage, user-scoped permissions.
- Human approval for irreversible or external actions.
- Output handling: no rendering of model-chosen links or images from untrusted domains, no executing output.
- Monitoring of tool calls for unusual patterns.
Anthropic's guide also recommends chaining these safeguards, since each catches different attacks.
Why the distinction matters in interviews
A chatbot with no tools mainly faces jailbreaks: the worst case is bad text. An agent with email, files and APIs faces injection: the worst case is real actions. Showing that you scale defences to what the system can do is the point.
Summary: "Jailbreaks attack the model's rules; injection attacks the application's authority. Filters help with the first; permissions and design handle the second."
Last updated 16 October 2026
Sources