Examples

Prompt injection examples worth knowing

OWASP documents nine attack scenarios. Grouped by how the hostile text arrives, they show where your own tools are exposed.

Last reviewed against NCSC, OWASP GenAI Security Project and Microsoft Security Response Center. Sources

The catalogue

How the text arrives

OWASP lists nine scenarios under its prompt injection entry [2]. Rather than repeat them in order, this page groups them by route, because the control you need follows the route.

Sack marked FINE beside stacks of coins and a gavel

Typed straight in

A support chatbot is told to ignore its rules, reach private data and send emails [2]. A meaningless string appended to a prompt can also get past safety measures, which OWASP calls an adversarial suffix [2].

Group of people gathered around one seated person with question marks above them

Hidden in content

A summarised web page carries concealed instructions that make the model add a link leaking the conversation [2]. A tampered document in a retrieval repository steers answers towards misleading output [2].

Cloud above a green shield with a padlock beside a stack of blue servers

Disguised to dodge filters

Switching language, or encoding the text in Base64 or emojis, can get past filters [2]. A malicious prompt can also be split across a document, with the pieces combining when the model reads it [2].

Tall blue server rack with glowing status lights

Carried by another format

Instructions hidden in an image can change how a multimodal model treats the text beside it [2]. OWASP flags this as an emerging risk [2].

Real world

A case with a CVE

OWASP's list includes an email assistant flaw, CVE-2024-5184, exploited to expose data and alter email content [2]. The better-known case is EchoLeak in Microsoft 365 Copilot [4].

Not every case is an attack

OWASP's unintentional example involves a job description with a hidden instruction to flag applications drafted with an LLM, set off by an applicant whose CV was tuned for one [2]. The tool misbehaved with nobody trying to attack it.

Using the list

Questions for your own tools

Read each scenario against one tool you run:

  1. 1

    Where does outside text enter? Typed input, mail, web pages, uploads or images.

  2. 2

    What could the tool do if it obeyed that text? Send, fetch, change or reveal.

  3. 3

    What stands between the text and the action? A person, a fixed rule, or nothing.

The three-question checker on the home page asks a shortened version. For the controls that follow, go to preventing prompt injection.

Keep reading

Read next

Hooded figure holding up three theatre masks in front of their face

Direct vs indirect

How direct and indirect prompt injection differ, why indirect injection is the harder problem for business tools, and what each means for defence.

Read the guide Risk gauge with red, amber and green sections and an arrow above it

Lethal trifecta

The lethal trifecta explained: private data, untrusted content and outward communication. How to check your AI tools and remove one of the three.

Read the guide Database stack, monitor with code symbols, document and cloud download arrow beside a green padlock

Vs SQL injection

Why the NCSC says prompt injection is not SQL injection, why parameterised queries have no equivalent, and what 'confusable deputy' means in practice.

Read the guide

How CyPro can help

Need a hand planning for this?

Understanding the change is one job. Working out what it means for your systems, your suppliers and your roadmap is several more. CyPro's consultants can take any of them on.

Security lead advising a board

Fractional CISO for the board

A senior security lead who advises the board on what to fix first, what to accept and what to tell customers, and owns the decision record.

More on cypro.co.uk
Cyber security consultants planning hardening work

Hardening and segmentation

Our consultants put the controls in place that limit the damage when something is missed: firewall rules, network isolation and tighter admin access.

More on cypro.co.uk
Penetration tester probing an application for weaknesses

Penetration testing

A focused test of your systems and the controls around them, so you know they hold before an attacker finds out for you.

More on cypro.co.uk
Scanner checking internet-facing systems for weaknesses

Vulnerability scanning

Find every internet-facing system you run, including the forgotten ones, and see which are still on a vulnerable build.

See the scanning service
Security analysts monitoring systems around the clock

24/7 security monitoring

Our SOC analysts watch your systems day and night for the signs of an attack in progress: unexpected processes, new outbound connections, logins that do not fit.

More on cypro.co.uk
Incident responders containing an attack

Incident response

If you may already be compromised, our responders contain it, preserve the evidence, find out what was touched and get you running again safely.

More on cypro.co.uk
Talk to us Book a Free Consultation
Rocket launching from a cloud

Plan ahead

Want a plan for your organisation?

Prompt injection only shows up when someone tries it against your own tools. Penetration testing can probe the AI features you run or build, to see what a hostile instruction could reach.

Test your AI tools Book a Free Consultation