Promptective journal / Topic index
13 journal entries tagged prompt injection.
Zenity Labs shows how an indirect prompt injection in a public Web-to-Lead form reached Salesforce Agentforce account data and Slack. The reported chains are patched.
Read article
A benchmark study separates two trust boundaries: the metadata that wins a tool call and the return content that redirects the agent after it runs.
A two-stage MCP prompt injection study wins tool calls with optimised metadata, then redirects agents through malicious tool returns. Both boundaries need policy.
Read article
A revised study shows how a forged mailbox fault can make an unauthorised mailbox operation look like routine maintenance, and why verified state and authorised action are separate controls.
A revised study shows how forged mailbox faults can steer email agents into unauthorised actions, and why verified state and action authorisation are separate checks.
Read article
A preprint labels every input token with its origin and adds a learned attention bias, so suppression follows where text came from.
A new preprint labels each input token with its origin and adds a learned attention bias, reporting near-zero prompt-injection attack success.
Read article
Unit 42’s controlled support-agent demonstration traces a poisoned ticket through shell access to a replayable downstream credential.
Unit 42’s AWS AgentCore prompt injection research shows how shell access exposed an in-use credential, with lessons for tool scope and runtime isolation.
Read article
Google reports malicious workspace instructions and loader comments aimed at AI tools. The two techniques cross different trust boundaries.
Google reports a DUSTMAKER prompt injection attack targeting coding assistants. Learn how workspace instructions cross trust boundaries and what teams can check.
Read article
A study of image and audio inputs shows why agent evaluations need to record what was attempted, what reached a tool and what completed.
Explore multimodal prompt injection examples from a new preprint, and learn why attempted actions, tool calls and completed attacks need separate measures.
Read article
CVE-2026-82233 shows how an AI agent’s ordinary upload tool can turn hidden instructions and an approved tool call into sensitive local-file exposure.
CVE-2026-82233 let SiYuan’s AI agent copy sensitive local files through MCP, showing why tool approvals need action-level policy.
Read article
A Kiro prompt-injection flaw shows how repository content can steer an AI coding agent towards sensitive files, configuration changes and data exfiltration.
Read article
Controls for prompts, data, outputs and tools.
A practical framework for securing LLM applications at the boundary between trusted instructions, untrusted content, model output, and real-world actions.
Read guide
Techniques, risks and practical defences.
How attackers bypass LLM safety guardrails, the common techniques they use, and practical ways to defend AI applications.
Read guide
Recurring attack patterns and practical defences.
Review 15 illustrative prompt injection attack examples across direct, indirect and agent risks, with source-backed controls for reducing their impact.
Read guide
How it works and how to reduce the risk.
Learn how prompt injection attacks work, see practical examples, and compare controls for protecting LLM applications in this 2026 guide.
Read guide
Website analytics are off.
