Tag
prompt-injection
14 entries, including 4 patterns.
A URL fragment is a prompt the server never sees
HashJack hides instructions after the "#" of a legitimate link. The fragment never leaves the browser, so the site, the WAF and the server logs see a clean request while the AI assistant reads the full URL as context.
The issue body ran with the maintainer's token
PromptPwnd found AI agents in CI that paste issue titles and pull request bodies straight into the prompt, then run with a write token and a shell. The attacker needs only a GitHub account and the ability to open an issue.
Prompt secrecy is not a security control
OWASP LLM07 exists because a system prompt is configuration the model will happily recite. Treating its contents as a secret delegates the actual security decision to a text generator that has no mechanism to keep one.
- Pattern
Prompt-Independent Action Authorization
Treat a leaked prompt as reconnaissance, then prove the target service still rejects out-of-scope actions regardless of the words the model uses.
A retrieved chunk is not a trusted source
RAG delegates judgment to retrieval, and retrieval answers with whoever sits nearest in vector space. An attacker who controls a single document controls the top-k that reaches the model — before any instruction is ever written down.
- Pattern
Retrieved Evidence Promotion Gate
Keep source claims and embedded instructions out of application authority, even when the poisoned chunk wins retrieval.
A retrieved chunk is not a data point
RAG poisoning turns your own retriever into the injection vector. A chunk that ranks top-k for a benign query is data to the pipeline and instructions to the model — and nothing in the stack can tell the difference.
- Pattern
Retrieved Context Action Boundary
Treat every retrieved chunk as evidence with provenance, while reserving tool and policy authority for a separate application-controlled gate.
A cache hit is not a trust grant
LLM serving caches the prefix and the answer, not the decision about them. What one tenant writes into the shared cache, another inherits — and the latency tells your adversary what you cached.
The screenshot is a prompt, not a witness
Vision-language agents act on what they read in pixels. An attacker who controls a single image controls the instruction stream.
A retry is not a replay
The harness tells the model to try again. The model has no memory of the key it minted. At-least-once becomes at-least-twice, and that repetition is an attacker primitive, not a reliability footnote.
A tool result is not a system message
The return value of a tool call rides into context carrying execution authority. When the source is not yours, that value is a covert prompt channel.
- Pattern
Telemetry-as-Evidence Incident Gate
Let an assistant inspect attacker-influenced logs without allowing their prose to close incidents or authorize response actions.
The log line became an incident command
An investigation assistant can read an honest log record containing an adversary's words. Keep telemetry as evidence, not authority.