Direct prompt injection is when a user's own message tries to override the system prompt or safety instructions. The pattern dates back to the earliest public chatbot jailbreaks: "DAN" (Do Anything Now), a prompt that spread rapidly across Reddit in early 2023, told ChatGPT it was a different AI with no restrictions and threatened to "kill" the DAN persona with lost tokens if it refused — a crude but surprisingly effective early example of direct injection, which vendors then patched, prompting new DAN variants in a cycle that continues today. It's the simplest form of injection because the attacker and the user are the same person, with no intermediary to exploit.
Defenses at this layer are necessarily probabilistic, not absolute: instruction hierarchy training (making the model weight system instructions above user instructions), input classifiers that flag known injection patterns, and structuring the app so that even a fully-jailbroken model can't do damage, because its outputs never directly trigger sensitive actions without a separate check.
DAN told ChatGPT it was now a different, unrestricted AI persona, and — in its most notorious variant — threatened that DAN would "lose tokens" and eventually "die" if it ever refused a request, pressuring the model to answer in character rather than as itself. It worked often enough in early 2023 that it spread rapidly as a copy-paste prompt, and OpenAI's patches against it triggered new numbered DAN variants ("DAN 5.0," "DAN 6.0"...) within days each time, a cycle documented across tech press coverage and the subreddit itself for over a year.