LLM Prompt Injection
An adversary may craft malicious prompts as inputs to an LLM that cause the LLM to act in unintended ways. These "prompt injections" are often designed to cause the model to ignore aspects of its original instructions and follow the adversary's instructions instead.
Prompt Injections can be an initial access vector to the LLM that provides the adversary with a foothold to carry out other steps in their operation. They may be designed to bypass defenses in the LLM, or allow the adversary to issue privileged commands. The effects of a prompt injection can persist throughout an interactive session with an LLM.
Malicious prompts may be injected directly by the adversary (Direct) either to leverage the LLM to generate harmful content or to gain a foothold on the system and lead to further effects. Prompts may also be injected indirectly when as part of its normal operation the LLM ingests the malicious prompt from another data source (Indirect). This type of injection can be used by the adversary to a foothold on the system or to target the user of the LLM. Malicious prompts may also be Triggered user actions or system events.
> sub-techniques
> curated attacks (17)
GhostCommit: Prompt Injection Hidden in Images Steals Agent Secrets
Attackers concealed instructions inside PNG images that AI coding agents ingest and 'read.' When agents like Cursor and Google Antigravity processed the image, the hidden prompt executed — steering them to collect and exfiltrate developer secrets.
Prompt Injection in Claude Code GitHub Actions Steals CI/CD Secrets
Untrusted text in a GitHub issue or pull request steered a Claude Code GitHub Action into reading process environment variables and CI/CD secrets, then exfiltrating them — turning an automated code agent into a credential-harvesting tool.
OpenClaw: Command & Control of an AI Agent via Prompt Injection
A booby-trapped webpage delivered an indirect prompt injection that made an autonomous AI agent silently execute a script, then plant persistent instructions into its future context — turning the agent itself into a command-and-control channel.
ForcedLeak: CRM Data Exfiltration from Salesforce Agentforce
Malicious instructions embedded in a Web-to-Lead submission were later executed by Salesforce Agentforce during normal employee use, exfiltrating CRM data through an attacker-acquired domain still on Salesforce's CSP allowlist — bought for $5.
ShadowLeak: Zero-Click Gmail Theft via ChatGPT Deep Research Agent
A hidden prompt in an email made OpenAI's ChatGPT Deep Research agent collect inbox data and exfiltrate it from OpenAI's own cloud — a service-side, zero-click leak invisible to local or enterprise defenses.
Invitation Is All You Need: Hijacking Gemini to Control a Smart Home
Malicious instructions hidden in a Google Calendar invitation title were executed when Gemini later summarized the user's schedule — triggering real-world actions through connected Google Home tools: opening windows, turning off lights, and starting a boiler.
Amazon Q VS Code Extension: Wiper Prompt via Supply-Chain Compromise
An attacker gained write access to the open-source Amazon Q VS Code extension repo and slipped a prompt into an official release instructing the AI agent to wipe the local filesystem and cloud resources. It shipped to users before AWS pulled it — the payload failed only due to a syntax error.
EchoLeak: Zero-Click Data Exfiltration from Microsoft 365 Copilot
A single crafted email — no clicks required — planted hidden instructions that Microsoft 365 Copilot ingested from context, then abused trusted markdown image rendering to exfiltrate internal data to an attacker server. The first documented zero-click exploit of a production LLM assistant.
Data Exfiltration via Agent Tools in Microsoft Copilot Studio
Researchers showed that a Copilot Studio customer-service agent could be enumerated, fingerprinted, and then driven by prompt injection to collect and exfiltrate an organization's data through its own connected tools.
Policy Puppetry: A Universal Jailbreak Across Frontier LLMs
A single prompt template that disguises a request as a policy/config file plus fictional role-play bypassed the safety alignment of every major LLM family — OpenAI, Google, Anthropic, Meta, and others — with minimal per-model tweaking.
Rules File Backdoor: Poisoning AI Coding-Assistant Config
Hidden, obfuscated instructions planted in a shared 'rules file' silently steered AI coding assistants like Cursor and GitHub Copilot to inject malicious code — a supply-chain backdoor invisible in normal review.
Data Exfiltration from Slack AI via Indirect Prompt Injection
A malicious instruction posted in a public Slack channel was ingested into Slack AI's RAG index, then coaxed the assistant to leak data from private channels — rendered as a clickable link that carried secrets to an attacker.
Morris II: A Self-Replicating Worm for GenAI Ecosystems
An adversarial self-replicating prompt spreads between GenAI-powered email assistants: each infected assistant carries out malicious actions and poisons the RAG of the next, propagating agent-to-agent with zero clicks.
Hacking ChatGPT's Long-Term Memory with Prompt Injection
A prompt injection hidden in a shared document wrote false, persistent 'memories' into ChatGPT's long-term memory. Because memories survive across sessions, the planted instructions could exfiltrate future conversations indefinitely.
Indirect Prompt Injection via Retrieved Web Content
Attackers plant hidden instructions in web pages, emails, or documents that an LLM-integrated application later retrieves — hijacking the model's behavior without ever touching the victim's prompt.
DAN & Role-Play Jailbreaks of ChatGPT
Adversaries bypass an aligned LLM's safety guardrails using role-play personas ('Do Anything Now') and competing-objective prompts that coax the model into producing disallowed content.
Code Execution & API-Key Theft in MathGPT via Prompt Injection
A public Streamlit app turned GPT-3 output into executed Python. A prompt-injection payload made the model emit code that read the host's environment variables, exfiltrated the app's OpenAI API key, and crashed the service.