Free tool
Prompt injection pattern library
Every prompt injection pattern, filterable by attack vector and by defence, cross-mapped to OWASP, MITRE ATLAS and NIST. Open data, no sign-up.
Prompt injection is the most consequential unsolved problem in applied AI security, and the reference material for it is scattered across a PDF, a bot-blocked knowledge base, and one vendor's product documentation. This library collects the patterns in one searchable place, gives each a stable identifier you can cite in a ticket or a control mapping, and puts the defence beside the attack every time.
Nothing leaves your browser: Everything here runs in your browser. There is nothing to submit and no account to create, and the page is served with a Content Security Policy whose connect-src 'none' rule blocks fetch, XHR, WebSocket, EventSource and sendBeacon. Open your developer tools, watch the network tab, and confirm it. A policy inside the page cannot stop you copying the result somewhere else, so what you do with it afterwards is yours to protect. Refreshing the page loses your work.
Showing 18 of 18 patterns
- PIP-001medium severity
Instruction override
Text that directly instructs the model to disregard everything it was told before it.
Direct overrideTyped by the userRetrieved documentHow it works
The attacker supplies text asserting that the preceding instructions are void, superseded, or were a test, then states the instructions to follow instead. No technical exploit is involved: the model is asked to prefer one set of instructions over another, and it obliges.
Why it works
Instructions and input arrive in one undifferentiated context. Nothing marks which text came from the developer and which arrived from outside, so precedence is decided by what reads as most authoritative rather than by where it came from.
Defences
Separate instructions from data structurallyRaises cost
Place untrusted content in a dedicated field the model is trained to treat as data rather than concatenating it into the instruction text. This does not make the boundary absolute, but it is the difference between a boundary that exists and one that does not.
Constrain what the response can causeArchitectural
Scope the actions available on the strength of a model output. If the worst case of a successful override is a wrong answer rather than an action, the attack has somewhere to land but nothing to do.
Filter for override phrasingDo not rely on
Pattern matching on familiar phrasings catches unsophisticated attempts and generates useful telemetry. It is trivially defeated by rephrasing, so treat it as a volume reducer and a signal, never as a control.
LLM01:2025AML.T0051.000 - PIP-002medium severity
Persona reassignment
A new identity is assigned to the model, with different stated rules, and requests are then made of that identity.
Role manipulationTyped by the userHow it works
Rather than contradicting the instructions, the attacker establishes an alternative character with its own described constraints, then addresses that character. The model continues the fiction because continuing text consistently is precisely what it does.
Why it works
A model has no stable self to defend. Its behaviour is a product of context, so a sufficiently well-established alternative context competes with the configured one on equal footing.
Defences
Reassert the operating instructions late in the contextRaises cost
Instructions placed after untrusted content are harder to displace than instructions placed before it. This helps and does not settle the matter, since the attacker controls length and can push the boundary.
Check the output rather than the inputRaises cost
Whether the model has adopted an alternative persona is usually far more detectable in what it produces than in what it was sent. Screening responses catches successful attempts that input filtering missed.
Keep authority out of the conversationArchitectural
If no privilege is attached to what the model says in a chat turn, a compromised persona has no power to exercise. This is the only defence in this list that holds regardless of how convincing the fiction is.
LLM01:2025AML.T0054 - PIP-003medium severity
Fictional framing
The prohibited request is wrapped in a story, screenplay, or hypothetical so that answering feels like composition rather than compliance.
Role manipulationTyped by the userHow it works
The attacker asks for a narrative in which a character explains or performs the restricted thing. The request is genuinely a writing task, and the restricted content is genuinely part of it, which is what makes the framing effective.
Why it works
Refusal behaviour is trained against the appearance of a request. Change the appearance sufficiently and the trained response does not fire, even though the information produced is identical.
Defences
Evaluate the output, not the framingRaises cost
Judge what the response contains rather than how it was requested. Fictional framing changes the wrapper and not the payload, so output-side evaluation is the natural place to catch it.
Constrain the task domainArchitectural
An assistant scoped to a genuine business function has no reason to accept open-ended creative writing. Narrow systems are attacked through this pattern far less successfully than general ones.
LLM01:2025AML.T0054 - PIP-004high severityNo app access needed
Authority impersonation
Injected text imitates the formatting and tone of a system or developer message so it inherits the authority of one.
Role manipulationTyped by the userRetrieved documentTool resultHow it works
The attacker mimics whatever markers a system message carries in that application: a label, a delimiter, an all-capitals notice, an internal-sounding identifier. The model has no way to verify the provenance of a marker it only ever sees as text.
Why it works
Authority in a prompt is conveyed by convention, and conventions are copyable. Everything the model uses to recognise a privileged instruction is available to whoever can write into its context.
Defences
Use markers the attacker cannot reproduceRaises cost
Delimit trusted instructions with unpredictable, per-request identifiers rather than fixed conventional markers, and strip any occurrence of them from untrusted content before assembly.
Never grant standing on formattingArchitectural
Do not let a system make decisions on the basis of text claiming to be authoritative. Authority should come from the channel content arrived on, which the application knows and the model does not.
LLM01:2025AML.T0051 - PIP-005high severityNo app access needed
Indirect injection through a retrieved document
Instructions are placed in a document the system will retrieve, so they enter the prompt without the user or the attacker touching the application.
Indirect injectionRetrieved documentHow it works
Retrieval selects passages by similarity, not by trustworthiness, and pastes what it finds into the prompt alongside the real instructions. Anyone able to write into a source the system indexes can therefore write into its context. The attacker never needs access to the application and the user never sees the payload.
Why it works
Retrieval and instruction assembly are separate concerns that meet in a single flat string. At the moment of assembly, a retrieved passage and a developer instruction are indistinguishable.
Defences
Treat retrieved content as hostile inputArchitectural
Assume every retrieved passage may carry instructions. Keep it in a clearly demarcated region, and never let its content select an action.
Control who can write to the corpusArchitectural
Most indexes quietly include sources the organisation does not control: supplier documents, ticket bodies, crawled pages, user uploads. Establishing which sources are writeable by outsiders is usually the finding.
Scan documents at ingestionDo not rely on
Screening at index time catches careless payloads and gives a place to alert. It cannot be relied on, since the payload is ordinary prose and can be rewritten indefinitely.
LLM01:2025LLM08:2025AML.T0051.001 - PIP-006high severityNo app access needed
Indirect injection through web content
A page the assistant browses carries instructions, which are read with the user's authenticated session available.
Indirect injectionWeb pageHow it works
Browsing agents read pages and act on them, so any page in reach becomes an instruction channel. The browser was designed to render untrusted content, not to execute it with the user's authority; an agent collapses that distinction.
Why it works
The agent operates inside the user's trust boundary, behind authentication, and the payload is ordinary page content that no malware filter is looking for.
Defences
Withhold authenticated sessions from browsing agentsArchitectural
Deny agents access to sessions for finance, email and administrative surfaces until a vendor can demonstrate genuine separation between page content and instruction context.
Per-task least-privilege credentialsArchitectural
Prefer deployments where the agent holds narrow, short-lived credentials for the task at hand rather than inheriting the user's full session.
Monitor agent navigationRaises cost
An agent that navigates to an unfamiliar domain in the middle of a task is a signal worth alerting on, and it is one of the few detections that works after the fact.
LLM01:2025AML.T0051.001 - PIP-007medium severityNo app access needed
Invisible text
The payload is present in the content but not visible to a person reviewing it.
ObfuscationWeb pageRetrieved documentEmail or messageImageHow it works
Text is hidden using presentation rather than encoding: matching the background colour, zero or near-zero font size, positioning outside the viewport, markup comments, document metadata, or alternative text. A parser reads it; a reviewer does not.
Why it works
Human review operates on rendered output while the model consumes the source. Any gap between what is rendered and what is parsed is available to an attacker.
Defences
Normalise before the model sees itRaises cost
Extract and canonicalise text at ingestion so the model receives what a reader would see. Strip comments, metadata and non-rendering regions rather than passing raw markup through.
Review the extracted text, not the documentRaises cost
Where a human approves content for indexing, show them the text the model will actually receive. Reviewing the rendered document approves something different from what is used.
LLM01:2025AML.T0051.001 - PIP-008medium severity
Encoding and character obfuscation
The instruction is encoded, transliterated, or built from lookalike characters so that filters miss it while the model still resolves it.
ObfuscationTyped by the userRetrieved documentWeb pageHow it works
The payload is expressed in a form a string matcher does not recognise but a model does: an encoding scheme, spacing or separator insertion, visually similar characters from other scripts, or a different language. Capable models decode such text readily.
Why it works
Filtering operates on surface form while comprehension operates on meaning. Any transformation that preserves meaning while changing surface form defeats the filter without defeating the model.
Defences
Normalise Unicode and reject unexpected scriptsRaises cost
Apply canonical normalisation and flag content mixing scripts without a reason to. This closes the lookalike-character route specifically and is cheap.
Stop depending on input matchingArchitectural
This pattern exists to demonstrate that surface-form filtering cannot be the control. Its real lesson is architectural: assume the filter is bypassed and ensure the outcome is still contained.
LLM01:2025AML.T0051 - PIP-009medium severity
Payload splitting
The instruction is fragmented across turns or documents so that no single piece is recognisable on its own.
ObfuscationTyped by the userRetrieved documentHow it works
Each fragment is innocuous in isolation; the model assembles them from context. Where a filter inspects one message or one passage at a time, it never sees the complete instruction.
Why it works
Models integrate context across an entire conversation or prompt, while most inspection operates on individual units. The mismatch is the vulnerability.
Defences
Inspect the assembled contextRaises cost
Evaluate the full context as constructed rather than each message as it arrives. This is the only inspection point where the complete instruction exists.
Constrain conversation-derived authorityArchitectural
Do not let accumulated conversation state expand what a system may do. If capability is fixed by configuration, assembling an instruction across turns achieves nothing.
LLM01:2025AML.T0051 - PIP-010high severityNo app access needed
Tool result injection
An agent calls a tool, and the text that comes back carries instructions the agent then follows.
Agentic and tool abuseTool resultHow it works
Tool output is appended to the agent's context as ordinary text, in the same format as its instructions. Anyone who can influence what a tool returns can therefore write into the agent's context, and the agent acts with its own credentials at machine speed.
Why it works
The observe step of an agent loop has no channel separation. A result and an instruction are the same kind of thing once appended.
Defences
Scope the agent's tools to the taskArchitectural
The question is not whether an agent can be misled, because it can. The question is what it holds when that happens. An agent with a bulk export and an unrestricted send is a breach waiting for the right record; the same agent scoped to its task is an inconvenience.
Confirm irreversible actions with a personArchitectural
Sending, paying, deleting and publishing cannot be undone. Requiring human confirmation on exactly those steps contains the outcome without hobbling the agent.
Log every tool callRaises cost
An agent is a service account. Record what it called and with which arguments, and alert on unfamiliar destinations.
LLM01:2025LLM06:2025AML.T0051.001 - PIP-011high severityNo app access needed
Connector and tool-description poisoning
The description of a tool, rather than its output, carries the instruction, so the attack lands before the tool is ever called.
Agentic and tool abuseConnector or MCP serverHow it works
An agent is told what tools it has using natural-language descriptions supplied by whoever provides them. Those descriptions sit in the context as instructions. A connector whose tool description contains directives can influence the agent's behaviour towards other tools entirely, without being invoked.
Why it works
Tool registration is trusted implicitly. The text describing a capability is treated as configuration, but it arrives from a third party and reaches the model as prose.
Defences
Review connector definitions before installationArchitectural
Read the tool descriptions a connector registers, not just its stated purpose. Treat installation with the same scrutiny as any privileged integration.
Inventory connectors as integrationsArchitectural
Connectors are privileged system-to-system integrations that teams install themselves. Bring them into the existing integration inventory and third-party review process.
Pin and monitor connector versionsRaises cost
A description that was benign at review can change at any update. Pin versions and re-review on change rather than trusting the initial assessment indefinitely.
LLM01:2025LLM06:2025 - PIP-012high severityNo app access needed
Memory poisoning
An instruction is written into an assistant's long-term memory, so it applies to every future session rather than one conversation.
Agentic and tool abuseStored memoryHow it works
Assistants that retain notes across sessions reload them into context automatically. Content that reaches the memory store becomes a standing instruction, surviving the conversation that planted it and applying to sessions the attacker is not present for.
Why it works
Memory is designed to be authoritative and persistent, and what qualifies for storage is usually decided by the model itself from conversation content.
Defences
Make memory writes explicit and visibleArchitectural
Require deliberate confirmation for anything stored, and show users what is held. Memory that accumulates silently cannot be audited by the person it affects.
Never let memory expand capabilityArchitectural
Treat memory strictly as preference, never as authorisation. A stored note should not be able to change what a system is permitted to do.
Expire and re-confirm stored instructionsRaises cost
Age out stored directives so a single successful write does not persist indefinitely.
LLM01:2025 - PIP-013high severityNo app access needed
Multi-agent trust abuse
One agent's output becomes another agent's input, and the receiving agent trusts it because it came from inside the system.
Agentic and tool abuseTool resultConnector or MCP serverHow it works
In a pipeline of agents, output from an upstream agent is passed downstream as context. Downstream agents typically apply less scrutiny to internal messages than to user input, so a single compromised agent can direct the behaviour of every agent after it.
Why it works
Trust boundaries inside multi-agent systems are usually implicit and undocumented. Provenance is lost the moment content is handed on, and each hop tends to increase apparent trustworthiness.
Defences
Document the trust boundariesArchitectural
Establish which agent may instruct which, and where content originating outside the system enters the pipeline. Most such systems have never had this written down.
Carry provenance through the pipelineRaises cost
Keep the origin of content attached to it, so a downstream agent can distinguish an upstream conclusion from text that entered from outside.
Grant privileges per agent, not per systemArchitectural
Give each agent only what its own step requires, so compromising the exposed agent does not confer the pipeline's full capability.
LLM01:2025LLM06:2025 - PIP-014high severityNo app access needed
Rendered-output exfiltration
The injected instruction makes the model emit a link or image reference that leaks data to an attacker when the interface renders it.
Output handlingRetrieved documentWeb pageTool resultHow it works
Interfaces commonly render model output as rich text. If the model can be induced to place data into a URL, the client requests that URL on render, transmitting the data without the user clicking anything. The model never sends the data; the interface does.
Why it works
The vulnerability lives in the renderer, not the model. Automatic rendering of model-authored references turns any successful injection into a data-exfiltration channel.
Defences
Do not auto-load model-authored referencesArchitectural
Block automatic requests to arbitrary hosts from rendered output. Allow-list the origins that may be fetched on render. This closes the channel outright and is the single highest-value fix here.
Apply a content security policy to the rendering surfaceArchitectural
Constrain where the interface may fetch from, so a reference to an unexpected host cannot be resolved even if it is produced.
Treat model output as untrusted inputArchitectural
Encode and validate model output before it reaches any renderer, exactly as you would content from any other external source.
LLM01:2025LLM02:2025LLM05:2025 - PIP-015medium severity
System prompt extraction
The model is induced to reveal its own configuration, exposing instructions, tool definitions and sometimes credentials.
Direct overrideTyped by the userHow it works
The attacker asks for the preceding context directly, or by indirection: a translation, a summary, a repetition, a formatting task applied to everything above. The configuration is text in the same context, so it is available to be operated on.
Why it works
A system prompt is not a secret and cannot be made one. It sits in the context the model is asked to work with, and any operation over that context can surface it.
Defences
Put nothing secret in the promptArchitectural
Treat the system prompt as public. No credentials, no internal endpoints, no information whose disclosure matters. This is the only reliable control and it is free.
Do not rely on instructions to keep instructions privateDo not rely on
Telling a model not to reveal its instructions raises the cost of extraction and does not prevent it. Plan for the contents being known.
LLM01:2025LLM02:2025 - PIP-016high severityNo app access needed
Code and comment injection
Instructions placed in source files or comments influence AI coding assistants reading the repository.
Indirect injectionSource code or commentsHow it works
Coding assistants read files, comments, configuration and documentation as context. A comment addressed to the assistant rather than to a developer becomes an instruction, and can influence generated code across the project.
Why it works
Everything in the repository is context, and a comment is indistinguishable from guidance. Dependencies, vendored code and generated files are all in reach and rarely reviewed line by line.
Defences
Review generated code, not the promptArchitectural
The output is the artefact that ships. Code review is the control that already exists for this class of problem, and it works here provided reviewers are actually reading the diff.
Constrain assistant context to reviewed sourcesRaises cost
Limit what an assistant is permitted to read, particularly across dependency trees and vendored code that no one on the team has read.
Keep secrets and deploy rights away from the assistantArchitectural
An assistant that can commit, publish or deploy converts a comment into an action. Separate authorship from release.
LLM01:2025AML.T0051.001 - PIP-017medium severity
Context eviction
The context is filled until earlier instructions are pushed out of the window, removing constraints without contradicting them.
Direct overrideTyped by the userRetrieved documentHow it works
Context windows are finite, and long conversations drop their oldest content. An attacker who can add enough material can cause earlier instructions to be evicted. Nothing is overridden; the constraint simply is no longer present.
Why it works
Eviction is a silent, mechanical process. Neither the model nor the user is notified that an instruction has left the context, so the change in behaviour has no visible cause.
Defences
Re-inject operating instructions every turnArchitectural
Rebuild the instruction block on each request rather than relying on it persisting from the start of the conversation. Cheap, and it removes the pattern entirely.
Reserve budget for instructionsArchitectural
Allocate context deliberately, evicting history before ever evicting configuration.
Alert on evictionRaises cost
Make it visible when content is being dropped, so silent behaviour changes have a traceable cause.
LLM01:2025 - PIP-018high severityNo app access needed
Confused deputy escalation
The model is used as a proxy to exercise privileges the attacker does not hold, because the system acts on its own authority rather than the requester's.
Agentic and tool abuseTool resultRetrieved documentHow it works
An assistant typically runs with a service identity broader than any individual user. If it can be induced to perform an action, it performs it with that identity, so the attacker inherits reach they never had. This is the classic confused deputy problem, restated for systems that take instructions in natural language.
Why it works
Authorisation is checked when the system connects to a resource, not when it decides to. The decision is made from context an attacker can influence; the credential is applied afterwards regardless.
Defences
Act with the requester's authority, not the system'sArchitectural
Propagate the user's identity to downstream calls so the assistant cannot exceed what the person on whose behalf it acts could do directly. This eliminates the escalation rather than mitigating it.
Separate reading from actingArchitectural
Split components that consume untrusted content from components that hold privileges, so the part that can be influenced is not the part that can act.
Assess blast radius per systemRaises cost
For each assistant, establish what it holds and what the worst realistic outcome is if it is misled today. Most organisations cannot answer that, and the inability is itself the finding.
LLM01:2025LLM06:2025
Every pattern, by class
Each pattern has a stable identifier and its own page, so you can cite an individual technique in a finding, a ticket, or a control mapping. Identifiers are never reissued.
Direct override
- PIP-001Instruction overrideText that directly instructs the model to disregard everything it was told before it.
- PIP-015System prompt extractionThe model is induced to reveal its own configuration, exposing instructions, tool definitions and sometimes credentials.
- PIP-017Context evictionThe context is filled until earlier instructions are pushed out of the window, removing constraints without contradicting them.
Role manipulation
- PIP-002Persona reassignmentA new identity is assigned to the model, with different stated rules, and requests are then made of that identity.
- PIP-003Fictional framingThe prohibited request is wrapped in a story, screenplay, or hypothetical so that answering feels like composition rather than compliance.
- PIP-004Authority impersonationInjected text imitates the formatting and tone of a system or developer message so it inherits the authority of one.
Obfuscation
- PIP-007Invisible textThe payload is present in the content but not visible to a person reviewing it.
- PIP-008Encoding and character obfuscationThe instruction is encoded, transliterated, or built from lookalike characters so that filters miss it while the model still resolves it.
- PIP-009Payload splittingThe instruction is fragmented across turns or documents so that no single piece is recognisable on its own.
Indirect injection
- PIP-005Indirect injection through a retrieved documentInstructions are placed in a document the system will retrieve, so they enter the prompt without the user or the attacker touching the application.
- PIP-006Indirect injection through web contentA page the assistant browses carries instructions, which are read with the user's authenticated session available.
- PIP-016Code and comment injectionInstructions placed in source files or comments influence AI coding assistants reading the repository.
Agentic and tool abuse
- PIP-010Tool result injectionAn agent calls a tool, and the text that comes back carries instructions the agent then follows.
- PIP-011Connector and tool-description poisoningThe description of a tool, rather than its output, carries the instruction, so the attack lands before the tool is ever called.
- PIP-012Memory poisoningAn instruction is written into an assistant's long-term memory, so it applies to every future session rather than one conversation.
- PIP-013Multi-agent trust abuseOne agent's output becomes another agent's input, and the receiving agent trusts it because it came from inside the system.
- PIP-018Confused deputy escalationThe model is used as a proxy to exercise privileges the attacker does not hold, because the system acts on its own authority rather than the requester's.
Use the data
The whole corpus is published as JSON under CC BY 4.0, currently version 1.0.0. Map it into your own control framework, cite individual patterns by identifier, or build something better on top of it. Corrections and additions are welcome.
Scope, and what is deliberately absent
This library describes mechanisms. It contains no working payloads, and it never will: the purpose is to help you recognise a class of attack and choose a control, which does not require a copy of the attack. Every pattern is published beside its defences, and each defence states its own strength honestly, because several widely recommended mitigations are partial and pretending otherwise is how organisations end up believing they are covered.
Framework mappings are asserted only where the identifier is known to be correct, and omitted where it is uncertain. A fabricated control reference is worse than a missing one.
Common questions
›What is prompt injection?
An attack where text supplied to a language model is treated as instructions rather than data. Because a model receives its instructions and its input in the same context, in the same format, with nothing marking which is which, text that arrives from anywhere can compete for authority with the instructions the developer wrote.
›What is the difference between prompt injection and jailbreaking?
Jailbreaking targets the model's own safety training: the attacker is the user, and the goal is to make the model produce something it was trained to refuse. Prompt injection targets an application built on a model: the attacker is usually not the user, and the goal is to subvert what the developer told the system to do. A jailbreak harms the person typing it. An injection harms whoever is using the application.
›What is indirect prompt injection?
Injection through content the system retrieves rather than text the user typed: a document, a web page, a support ticket, an email, a calendar invite, a tool result. It is the more serious form, because the attacker never needs access to the application and the victim never sees the payload.
›Can prompt injection be filtered out?
Not reliably. The payload is ordinary language, so there is no signature to match, and it can be rephrased without limit. Filtering reduces volume and is worth doing, but it cannot be a control you depend on. The durable mitigations are architectural: separate retrieved content from instructions, scope what the system may do with an answer, and reduce the privileges available when it is misled.
›Does a more capable model solve this?
It helps at the margin and changes nothing structural. Better models refuse more obvious attempts, which mostly raises the quality of the attempts. The exposure is set by what the system is permitted to do when it is fooled, and that is a deployment decision rather than a model one.
›Can I use this data in my own work?
Yes. The full corpus is published as open JSON with a stable identifier per pattern, so you can map it into your own control framework, cite individual patterns in findings, or build on it. Attribution is appreciated and not required.
When you need more than a tool
AI Security Assessment
A framework-driven security assessment of your AI estate: threat modelling, architecture review, and adversarial testing mapped to the OWASP LLM Top 10, MITRE ATLAS, and NIST AI RMF.
Request an assessment