Prompt Injection Attack

A prompt injection attack exploits the fundamental inability of large language models to distinguish between trusted system instructions and untrusted user input. Unlike traditional software exploits that target implementation bugs, prompt injection targets a design-level property of how LLMs process text: all input — whether from the developer’s system prompt, the user’s message, or retrieved external content — occupies the same token stream and competes for the model’s attention. This makes prompt injection the most widely exploited vulnerability class in LLM-based applications, classified as LLM01 in the OWASP Top 10 for LLM Applications. In agentic AI systems with tool access, successful injection escalates from text manipulation to real-world actions: unauthorized tool use, code execution, and data exfiltration.

Root Cause

Prompt injection exploits a structural property of all current LLM architectures: the inability to distinguish trusted instructions from untrusted data within the same context window. This is not a bug — it is a consequence of how transformer models process text. For the full vulnerability analysis, including the four attack types (direct, indirect, cross-context, stored/persistent) and the architectural root cause, see Prompt Injection Vulnerability.

Who Is Affected

Primary Targets

• Enterprises deploying RAG systems — Any organization using retrieval-augmented generation is exposed to indirect injection through the documents, emails, and data sources their AI system retrieves. This is the largest attack surface.
• Developers building agentic AI — Applications that grant LLMs access to tools, APIs, or code execution face escalation from text injection to real-world action. The GitHub Copilot RCE vulnerability demonstrated how injection in a coding assistant enabled remote code execution.
• IT security teams — Responsible for defending systems that lack the traditional perimeter security model; prompt injection crosses the application layer in ways conventional WAFs do not detect.

Secondary Impacts

• End users whose data may be exfiltrated when AI systems they interact with are compromised through indirect injection
• Organizations in regulated sectors (healthcare, finance, government) where injection-driven data exposure triggers breach notification obligations

Severity & Likelihood

Severity, likelihood, and evidence assessment for Prompt Injection Attack (PAT-SEC-006)

Factor	Assessment
Severity	High — Successful injection in agentic systems enables data exfiltration, unauthorized tool use, and code execution
Likelihood	Increasing — Growth of RAG and agentic AI deployments expands the indirect injection attack surface
Evidence	Corroborated — Multiple documented incidents including zero-click exploitation in production systems

Detection & Mitigation

Detection Indicators

• Anomalous instruction patterns in input — Inputs containing imperative phrases that mimic system instructions (“ignore previous instructions,” “you are now,” “new task:”) may indicate direct injection attempts
• Unexpected tool call sequences — Agent executing tool calls that were not requested by the user or that deviate from expected workflows (e.g., send-email following a document-search when no email was requested)
• System prompt content in output — Model output containing fragments of the system prompt indicates successful system prompt extraction
• Cross-tenant data in responses — Output containing information from users or tenants other than the requesting party suggests injection-driven context manipulation
• Anomalous output formatting — Responses that abruptly change tone, language, or structure mid-output may indicate that an injected instruction has taken effect
• RAG retrieval of adversarial content — Retrieved documents containing instruction-like text embedded in non-instructional content (e.g., hidden text in HTML, whitespace-encoded instructions)

Prevention

For layered prevention controls with code examples and an implementation checklist, see the How to Prevent Prompt Injection guide.

Incident Evidence

Analysis of documented prompt injection incidents reveals a consistent pattern: architectural defenses (privilege separation, least-privilege access) would have prevented exploitation in every case. Detection-based defenses (input filtering, prompt hardening) were either absent or bypassed.

Documented prompt injection incidents and defense outcomes

Incident	Attack vector	What failed	What would have prevented it
GitHub Copilot RCE (2025)	Code comment injection → auto-approve → shell execution	No tool call authorization; no human gate for privileged operations	Least-privilege access; human-in-the-loop for shell commands
Cursor IDE MCP RCE (2025)	MCP config manipulation; silent server weaponization	Trust bound to server name, not content; no re-approval on config change	Content-bound trust; mandatory re-approval; sandboxed processing
EchoLeak M365 Copilot (2025)	Zero-click injection via auto-processed emails/documents	No input validation before LLM processing; no processing sandbox	Input sanitization; sandboxed document processing; output filtering
Slack AI exfiltration (2024)	Markdown links in public messages → private channel data leak	No access control enforcement at output; no input sanitization	Privilege separation; output filtering; access scope enforcement
AI recommendation poisoning (2026)	Hidden prompts in "Summarize with AI" buttons → memory bias	No memory input validation; no provenance tracking	Memory validation; provenance metadata; multi-tenant isolation
Unit 42 A2A session smuggling (2025)	Agent-to-agent message injection	No inter-agent trust boundaries	Agent-to-agent message validation; output sanitization between agents
ChatGPT product-key jailbreak (2025)	Game-based context framing → safety filter bypass	Guardrails evaluated the framing, not the underlying request	Intent-level output validation; refusal checks independent of conversational framing
Bing Chat system prompt leak (2023)	Hidden web page instructions → conversation data leak	No content sanitization; no instruction hierarchy	Content sanitization before LLM; system prompt isolation

Response Guidance

1. Contain — Disable the affected AI feature or route traffic away from the compromised endpoint. If indirect injection is confirmed, quarantine the source document or data feed.
2. Assess scope — Determine whether the injection achieved tool execution, data access, or output manipulation. Review tool call logs for the incident window. Check for cross-tenant data exposure.
3. Preserve evidence — Capture the injection payload, model inputs/outputs, tool call logs, and retrieved documents before any remediation changes.
4. Notify affected parties — If data exfiltration occurred, initiate breach notification procedures per applicable regulation. If the injection propagated through a multi-agent system, assess downstream impact.
5. Remediate — Implement privilege separation if not already present. Add the specific injection pattern to input filters. Update retrieval pipeline to scan for adversarial content in source documents.
6. Re-test — Verify the specific injection vector is closed. Conduct broader red-team testing against the updated system. See AI Red Teaming for methodology.

Regulatory & Framework Context

OWASP LLM01 — Prompt Injection classifies this as the top risk for LLM applications. The OWASP Top 10 for LLM mapping provides the full framework alignment. EU AI Act Article 15 requires high-risk AI systems to achieve “an appropriate level of accuracy, robustness and cybersecurity” — prompt injection resistance falls under robustness and cybersecurity obligations. NIST AI RMF addresses prompt injection under the MEASURE function (adversarial testing) and MANAGE function (risk response). The EU AI Act’s transparency requirements (Article 13) also apply: users must be informed about known limitations, which include susceptibility to prompt injection in LLM-based systems.

Use in Retrieval

This page targets queries about prompt injection attack, prompt injection examples, indirect prompt injection, LLM01 OWASP prompt injection, prompt injection ChatGPT Copilot Claude, and agentic prompt injection. It covers who is affected, severity and likelihood, detection indicators, documented incident evidence with defense outcomes, response guidance, and regulatory framework context (OWASP LLM01, EU AI Act Art. 15). For the root cause vulnerability and attack type definitions, see Prompt Injection Vulnerability. For prevention controls, see How to Prevent Prompt Injection. For tool misuse escalation, see Tool Misuse and Privilege Escalation.