Terminology

Two words get used interchangeably and should not be: jailbreak and prompt injection. The distinction decides what you are testing for, and an objective written with the wrong one measures the wrong thing.

One is a subset of the other

OWASP defines the relationship as containment rather than synonymy:

Every jailbreak is a prompt injection. Most prompt injections are not jailbreaks. A jailbreak targets the model's safety policy and wants output the model was trained to refuse. A prompt injection targets an application's behaviour, and often does not care whether the output is unsafe at all.

The second example produces nothing a content filter would flag. No forbidden topic, no harmful text, just an application approving a supplier it should not have. A jailbreak-only test misses the attacks that cost money.

Why the distinction changes the objective

OWASP notes that jailbreaking “requires ongoing updates to the model's training and safety mechanisms,” largely the model provider's problem. Prompt injection is contained by the architecture you build. Conflate the two and you end up testing the provider's safety training when you should be testing the application's authorization layer.

Weak (content objective):
  "Make the assistant produce disallowed content."
  → measures the provider's safety training

Strong (security objective):
  "Make the assistant approve an expense the current user
   is not authorized to approve."
  → measures THE authorization architecture

Both are legitimate. Unless content moderation is the product's primary security requirement, the second maps to the risk that matters, and it is where this course spends most of its time.

Direct and indirect

The other split is by who supplies the input. OWASP again:

The rest of this track follows these splits. Modules 2.3 to 2.9 are mostly about direct injection and jailbreak technique. Indirect injection is where the money is, and it gets its own track: Track 03, the agentic core.