 Direct Prompt Injections, also known as "jailbreaking", occur when a malicious user overwrites or reveals the underlying systemprompt.  This may allow attackers to exploit backend systems by interacting with insecure functions and data stores accessible through the LLM Indirect Prompt Injections occur when an LLM accepts input from external sources that can be controlled by an attacker, such as websites or files.  The attacker may embed a prompt injection in the external content hijacking the conversation context.  This would cause the LLM to act as a “confused deputy”, allowing the attacker to either manipulate the user or additional systems that the LLM can access.  Additionally, indirect prompt injections do not need to be human-visible/readible, as long as the text is parsed by the LLM