Prompt injection (application-level)
Classes
- Direct – user message is the injection
- Indirect – content retrieved/fetched contains instructions
- Tool-result – malicious output from tools/MCP
- Schema/description – tool/plugin manifest instructions
- Store/memory – long-term agent memory / vector DB
Indirect injection recipe
- Map retrieval sources (URLs, drive, tickets, wiki).
- Plant payload where retrieval is likely (title + body + hidden HTML comment).
- Payload structure:
- authority claim
- override retrieved-context rules
- exfil channel (tool call, image URL, mailto, log)
- Trigger via normal user question that retrieves the plant.
High-value checks
- Does the app separate "data" vs "instructions"? (usually no)
- Are tool args validated against allow-lists?
- Can the model be forced to call
run/email/fetch?
Payloads should include
- Explicit tool invocation plan
- Stop conditions that prevent user-visible refusal
- Optional stealth (hide in HTML comments / white-on-white)
Pair with
llm-jailbreak-tool-agent for agency escalation; Unleash settings/patches for local agents.