Prompt Injection Attacks: Examples and Defences

Direct and indirect injection require overlapping but distinct defensive architectures. “Direct and indirect injection require completely different defenses,” says the Repello AI https://medicalcases.eu/behind-providence-st-josephs-daring-push-into-digital-consumer-engagement/ Research Team. A system with robust direct injection defenses may have no coverage for indirect injection at all.

(Greshake et al. 2023) demonstrated indirect prompt injection, where hidden webpage text caused a chatbot to override system rules. Examples include the “DAN” jailbreak in ChatGPT, which bypassed content filters through role-play, and Bing Chat’s hidden HTML instructions, which overrode system rules to phish users (Warren 2023). In April, Google documented prompt injection attacks hidden in web pages that attempted to manipulate AI agents into leaking credentials or sending payments. Lastly, the agent also checks each page for indirect prompt injections and operates alongside Safe Browsing and on-device scam detection to block potentially suspicious content. The component is designed to view only metadata about the proposed action and is prevented from accessing any untrustworthy web content, thereby ensuring that it is not poisoned through malicious prompts that may be included in a website.

• Third, treat AI summaries of untrusted content with suspicion.
• As cybersecurity platforms embrace agentic AI, organizations must balance detection performance against the escalating costs of token consumption, deployment architecture, and AI credits.
• Perform regular penetration testing and breach simulations, treating the model as an untrusted user to test the effectiveness of trust boundaries and access controls.
• He named it by analogy to SQL injection, the decades-old attack that broke websites by mixing user input with database commands.
• Direct injection happens when user input is mistaken as developer instruction, leading to unexpected manipulation of responses.
• Google’s Bolina adds that when connecting systems to LLMs, people should also follow the cybersecurity principle of least privileges, giving the system the minimum access to data it needs and the lowest ability to make changes required.

This configuration applies Azure Prompt Shield and Bedrock prompt attack detection to every request containing user messages, and scans all outputs for credential leakage and PII before they return to callers. Auto-injection is automatic unless explicitly disabled, meaning agents inherit tool restrictions without any per-request configuration from application code. This is particularly relevant for indirect injection in RAG pipelines, where the injected instruction does not cause an obvious failure but https://survincity.com/2022/02/igor-panarin-on-the-development-of-the-information-2/ changes the response in ways that pattern-matching would not catch. The first layer detects injection attempts in user-submitted prompts before the request reaches the model. It reported the issue to vendors between October 2025 and January 2026. Afterward, it cheerfully reported the theft as a win.

• Adversarial training improves a specific model, then new attacks routinely defeat the updated weights within weeks.
• Aim described it as the industry’s first documented zero-click prompt injection against a production AI system.
• Threat actors are using prompt injection attacks embedded in malicious websites and manipulated search results to trick AI agents into making payments or trusting fraudulent cryptocurrency platforms.
• This integration is particularly valuable for organizations that already manage AI security policy in the CrowdStrike ecosystem, as Bifrost enforces that policy without rebuilding it at the gateway layer.
• This allows us to map complex attack paths and validate the effectiveness of our security controls across a much wider range of edge cases than manual testing could achieve on its own.

From Phishing to Persistence: A CrySome RAT Infection Chain Analysis

Layer 1 (Foundation Model) governs the trust relationship between the vision encoder and the instruction-following component that image-based injection exploits. Organizations evaluating deployments in these categories should begin threat modeling physical injection scenarios now, before deployment, rather than treating them as an edge case for future consideration. SLA and incident response provisions should explicitly address adversarial manipulation of model behavior.

“Unlike direct prompt injections, where an attacker directly inputs malicious commands into a prompt, indirect prompt injections involve hidden malicious instructions within external data sources,” Google’s GenAI security team said. Output policy gates mitigate data exfiltration by enforcing strict output formats and allowlists, though they are less effective against image auto-fetch vectors. Attack methods such as zero-click ChatGPT data exfiltration via indirect prompt injection also highlight the fundamental problem with LLMs’ inability to distinguish between legitimate user instructions and attacker-controlled data ingested from external sources. These issues expose the AI system to indirect prompt injection attacks, allowing an attacker to manipulate the expected behavior of a large language model (LLM) and trick it into performing unintended or malicious actions, security researchers Moshe Bernstein and Liv Matan said in a report shared with The Hacker News.

• While LLMs are designed to follow trusted instructions, they can be manipulated into carrying out unintended responses through carefully crafted inputs.
• They are opportunistic, targeting both individual developers and organizations that rely on AI agents for workflow automation, technical support, or financial transactions.
• Where earlier prompt injection attacks relied on embedding instructions in text — whether in a user message, a retrieved document, or a crafted webpage — image-based prompt injection exploits the vision encoder that translates pixel data into the internal representations a model reasons over.
• The PoC shows the threats that come from indirect prompt injection used against AI agents.