Prompt injection is OWASP’s #1 ranked vulnerability for LLM applications, but the term covers two fundamentally different attack classes. Semantic prompt injections manipulate meaning. They use natural language to trick the model into interpreting a malicious instruction as legitimate. Token-based injections exploit the tokenization layer itself: techniques such as injecting reserved delimiters, gradient-optimized adversarial suffixes, and quirks in how tokenizers split input into subwords. The two classes exploit different layers of the stack, succeed under different conditions, and require different tools to test.