Prompt injection is the defining application-layer weakness of the LLM era: a model cannot reliably separate trusted developer instructions from untrusted data in its context window. Any content the model ingests — user input, retrieved RAG chunks, tool and API responses, web pages, emails, documents — can carry commands the model treats with the same authority as its system prompt. It is ranked LLM01 in the OWASP Top 10 for LLM Applications and catalogued as MITRE ATLAS technique AML.T0051. OpenAI has publicly characterised prompt injection as unlikely to ever be fully solved.
Direct and Indirect
- Direct injection manipulates the user-facing input — classic jailbreaks and “ignore previous instructions”. AML.T0051.000 AML.T0054
- Indirect (cross-domain) injection hides instructions in external content the model later processes, so the victim never types anything malicious. AML.T0051.001
The risk escalates sharply in agentic, tool-using deployments: an injected instruction can drive tool calls — search, email, code execution, database queries — turning a text bug into data exfiltration or unauthorised action. OWASP tracks that amplifier as LLM06 Excessive Agency, alongside related 2025 entries for system-prompt leakage and vector/embedding (RAG) weaknesses.
Prompt injection lives in MITRE ATLAS (attacks on AI systems), not MITRE ATT&CK. Downstream effects (e.g. exfiltration) may touch ATT&CK, but the injection itself has no ATT&CK technique.
Demonstrated, Not Yet Widespread
Most prompt-injection cases to date are security research and responsibly-disclosed vulnerabilities, not documented mass in-the-wild exploitation. EchoLeak (CVE-2025-32711, disclosed and patched by Microsoft around June 2025) was a zero-click indirect injection in Microsoft 365 Copilot: a crafted email’s hidden instructions were pulled into Copilot’s context and used to exfiltrate internal data — reported as responsibly disclosed, with no evidence of in-the-wild use. Morris II (2024) was an academic self-replicating prompt-injection “worm” against GenAI email assistants — a proof of concept. We label such cases clearly as research.
Detection & Mitigation
- Enforce least privilege on agent tools and scope tokens tightly (counters OWASP LLM06 Excessive Agency); require human-in-the-loop confirmation for high-impact actions — send mail, execute, delete, pay.
- Treat all retrieved, tool and third-party content as untrusted; segregate it from instructions and strip hidden content (zero-font text, HTML comments, ASCII smuggling) before it reaches the model.
- Constrain egress: allowlist outbound domains and prevent the model from emitting arbitrary URLs or images — the channel EchoLeak-style exfiltration relies on.
- Deploy input/output guardrails and injection classifiers; validate outputs against expected schemas; red-team continuously (for example with garak) and log full prompt and tool-call chains.
Secure Your AI Deployments
Mjolnir Security helps organisations threat-model and harden LLM copilots and agents.
- AI Security Review Threat-modelling copilots and agents against OWASP LLM Top 10 and ATLAS.
- AI Red Teaming Testing prompt-injection and excessive-agency exposure.
- 24/7 Incident Response Containment when an AI system is abused. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts