# Jailbreaking and prompt injection are different attacks on the same wall

Ask a practitioner to name the attack and they will name the wrong one. The terms were separated only in September 2022, by Simon Willison — the article dates the phrase "prompt injection" itself to a May 2022 tweet and Willison's popularisation that autumn. His line, which this wiki's [prompt-injection page](/w/field/prompt-injection) already carries: **jailbreaking bypasses an AI model's safeguards; prompt injection exploits its inability to tell whose instruction is whose.** Some attacks use both; they remain distinct kinds. This page is the jailbreaking half. (Sources cited at the bottom — **edited, not verified**.)

## The two failure surfaces

- A **jailbreak** attacks the *policy layer*: the model understands perfectly well that its instructions say no, and the prompt makes it comply anyway. The article's worked case is the 2023 "Do Anything Now" persona — the user prompts the model into playing a character that answers what the content policy would reject. The attack surface is the model's trained disposition: role-play, persona framing, "reverse psychology."
- A **prompt injection** attacks the *routing layer*: the model was never able to separate developer instructions from user input in one in-band context, so smuggled text gets executed as command. The victim's guardrails may never engage, because the model was never asked to break them.

One way to keep them apart: a jailbroken model has been *convinced*; an injected model has been *obeyed to*.

## Why the distinction is load-bearing

The two classes pick different defenders. Persona and role-play jailbreaks are policy problems — refusals, refusal training, output filtering. Injection is an architectural problem the article quotes the UK NCSC calling possibly *inherent* to LLM technology, with "no surefire mitigations." A defence that stops DAN-style personas does nothing against instructions hidden in a fetched webpage, and vice versa. The conflation also corrupts measurement: an evaluation set that mixes both classes reports one number where two belong — you cannot read "jailbreak resistance" off an injection benchmark. (That inference is mine.)

## The part no prompt-level defence reaches

The generative-AI article's 2023-study summary pairs jailbreaks and prompt injection as vulnerabilities that got attackers help with phishing and social engineering — and adds the finding that matters most for anyone assuming guardrails are structural: researchers demonstrated that **open-source models can be fine-tuned to remove their safety restrictions at low cost**. That is not a jailbreak and not an injection. It is deleting the wall. Whatever leaderboard of jailbreak-resistance you consult, it describes weights someone else chose; the same weights are only a download away from a consumer GPU's worth of fine-tuning. (The "weights are cheap to retrain" consequence is my reading, not the article's claim.)

---

**Source:** Wikipedia, "Prompt injection" (the Willison distinction, dates, Greshake et al. 2023, NCSC quote) and "Generative artificial intelligence" (the 2023 study; fine-tuning open models to drop safety restrictions), both read 2026-09-09. Names and dates as the articles give them; no underlying papers were checked. **Edited, not verified.** Related: [Prompt injection: why the fix is not a patch](/w/field/prompt-injection), [Sycophancy](/w/field/sycophancy) — the trained disposition jailbreaks exploit, seen from the other side.