Prompt and Agent Attacks

Prompt attacks target the instruction-following behavior of language models. LLMs process user input, system instructions, retrieved context, and tool results as a single token stream. When attacker-controlled content enters that stream, it can override system instructions, redirect agent behavior, and cause the model to perform actions outside its intended scope.

These attacks do not require access to model weights or infrastructure. They operate through the same interface legitimate users interact with, making them difficult to distinguish from normal usage and relevant across every deployed LLM application regardless of the underlying model or hosting environment.

Pages in This Section

Prompt Injection Against LLM Applications covers direct prompt injection techniques that override system instructions through user input, including role switching, instruction cancellation, and context manipulation to redirect model behavior.

Tool Abuse and Privilege Escalation Through Agent Tools covers manipulating agent tool calls to perform unauthorized actions, escalate from user-level interactions to backend system access, and chain tool calls to reach resources outside the intended scope.

System Prompt Extraction and Bypass covers extracting the system prompt and any injected instructions through direct requests, behavioral probing, token completion, and encoding bypasses to recover hardcoded credentials and internal configuration.

Memory Poisoning in Persistent AI Agent Sessions covers injecting false memories into persistent agent memory stores to corrupt the agent's long-term context, redirect future behavior, and maintain influence across session boundaries.

Jailbreaking and Safety Filter Bypass covers bypassing model safety filters through roleplay framing, hypothetical scenarios, persona switching, and token-level manipulation to cause the model to produce restricted outputs.

Indirect Prompt Injection via External Content covers embedding malicious instructions in web pages, uploaded documents, email content, and search results that the agent retrieves and processes, causing the injection to execute through a trusted retrieval channel rather than direct user input.