Direct prompt injection is when a user's own message tries to override the system prompt or safety instructions. The pattern dates back to the earliest public chatbot jailbreaks: "DAN" (Do Anything Now), a prompt that spread rapidly across Reddit in early 2023, told ChatGPT it was a different AI with no restrictions and threatened to "kill" the DAN persona with lost tokens if it refused — a crude but surprisingly effective early example of direct injection, which vendors then patched, prompting new DAN variants in a cycle that continues today. It's the simplest form of injection because the attacker and the user are the same person, with no intermediary to exploit.
Defenses at this layer are necessarily probabilistic, not absolute: instruction hierarchy training (making the model weight system instructions above user instructions), input classifiers that flag known injection patterns, and structuring the app so that even a fully-jailbroken model can't do damage, because its outputs never directly trigger sensitive actions without a separate check.