A mid-sized fintech client came to us after a routine review flagged something nobody had considered: Their ticket-summarising agent had forwarded pricing data externally because a ticket contained malicious instructions telling it to. Nobody breached a server; the agent did what it was told. That is the pattern behind most prompt injection attacks: AI systems doing exactly what they were told, by exactly the wrong person. A large language model does not need a stolen password to hand an attacker your data.

Across 150+ engagements in 30+ industries, we have watched teams shipping AI agents move faster than they can reason about malicious input planted by someone else. This guide covers the attack types, real incidents, and the defence model that holds up once agents are in scope.

What Is a Prompt Injection Attack?

So what is prompt injection, and what is a prompt injection attack in practice? A prompt injection attack tricks a large language model into treating attacker text as a trusted instruction rather than untrusted content. Here is the mechanism behind nearly every prompt injection LLM attack recorded so far:

• The core flaw: LLM architecture cannot separate a trusted system prompt from untrusted input.
• No syntax boundary: Unlike SQL code and a parameter, nothing marks one part as instruction, the other as data.
• The execution step: Once the model treats injected text as an instruction, it acts on it exactly as it would act on a legitimate command. 
• The structural point: SQL injection is patchable; prompt injection is a condition of model reasoning; no patch fixes it.

Why LLMs Can't Tell Instructions from Data

Every prompt a large language model processes merges into one context window reasoned over as a single stream.

• System prompt, retrieved content, and user input arrive as identical text, with no built-in trust boundary.
• Input sanitization and content filters alone have a hard ceiling, since they cannot fix an architecture that treats all text the same way.

Types of Prompt Injection Attacks

Direct prompt injection is not dead, but it is no longer the dominant risk surface. The direct vs indirect prompt injection split shows where attacks enter, and each variant demands a different response.

Direct Prompt Injection

Direct injection happens when an attacker types override instructions straight into a chat interface, hoping the model treats the new text as a legitimate command.

• It still happens, mostly against customer-facing chatbots with an open input field.
• It requires access most background agents never expose, which limits its reach against automated workflows.

Indirect Prompt Injection

Indirect injection happens when malicious instructions hide inside emails or external content an agent reads on its own, such as documents pulled through RAG pipelines, with no human reviewing that content before the model acts on it.

• This is where enterprise findings concentrate, since it needs no direct access to the model at all.
• Researchers call the shared pattern the "lethal trifecta": Private data access, exposure to untrusted content, and the ability to communicate externally.
• When all three exist on one agent, indirect injection stops being hypothetical.

Stored and Multimodal Prompt Injection

This category covers evasion patterns that outlast a single exchange or reach beyond plain text, three variants attackers increasingly combine.

• Stored and session-based injection persists in memory until triggered later, known as session poisoning.
• Multimodal injection hides instructions inside images or audio, bypassing text-only filters.
• As agentic AI scales, attackers target multi-agent architectures and Model Context Protocol connections, passing adversarial input between agents.

Which risk to prioritise first?

1. Agent reads external content it did not generate? Prioritise indirect injection.
2. Agent retains memory or session state? Prioritise session poisoning.
3. Agent processes images/audio, or connects via MCP? Prioritise multimodal and multi-agent evasion.

Real-World Prompt Injection Examples

Sceptical teams ask whether this is really happening. Each incident below is a documented prompt injection attack example, and the escalation across the past two years is worth tracking.

From Chatbot Leaks to Zero-Click Enterprise Exfiltration

Three incidents mark the escalation from embarrassment to enterprise breach.

• 2024, Slack AI: A planted channel instruction caused the assistant to encode stolen data into a link, the first major prompt injection finding.
• 2025, EchoLeak (CVE-2025-32711): A zero-click AI exfiltration path against Microsoft 365 Copilot, pulling confidential information with no click.
• 2025, Cursor RCE (CVE-2025-54135): Indirect injection through MCP configuration escalated to remote code execution.

Agentic and MCP-Specific Incidents

The agentic layer surfaced its own incidents.

• GitHub MCP "Toxic Agent Flow": A booby-trapped public issue reached private repositories through an overprivileged MCP server token, exposing confidential data and API keys.
• 2026, MCP tool poisoning disclosures: Roughly 200,000 vulnerable instances confirmed the surface has moved to tool metadata.

These incidents share a pattern known as the promptware kill chain.

• An initial injection leads to data exfiltration, credential theft, or infostealer malware delivery.
• The security vulnerabilities rarely sit in the model; they sit in how much the agent was trusted to do.

Prompt Injection Techniques Attackers Use

Delivery type is only half the picture. Attackers rely on recurring construction patterns, distinct from delivery type, and knowing them separates a real defence from a filter that catches nothing sophisticated.

Payload Splitting, Obfuscation, and Trust Exploitation

Attackers lean on a handful of repeatable construction techniques.

• Payload splitting breaks a malicious prompt into fragments that look harmless individually, reassembled only at inference time.
• Encoding-based obfuscation, using Base64 or Unicode substitution, hides intent from content filters tuned for plain English.
• Trust exploitation is subtler: Attackers phrase instructions in polite, authoritative language, exploiting the cooperative behaviour models are trained for.
• Adversarial examples and adversarial patterns extend this further, bypassing a guardrail model until it is retrained.

Two supporting practices help, but neither closes the gap alone.

• Content sanitization, including HTML/Markdown sanitization, catches some malicious payloads before the model sees them.
• Microsoft Prompt Shields adds a content moderation layer, but no content filtering product catches every pattern.

Prompt Injection vs. Jailbreaking

Understanding prompt injection vs jailbreaking starts here: These terms get used interchangeably, which leads teams to buy the wrong defence. A single injection can trigger a jailbreak, but the two describe different points in an attack chain.

• Jailbreaking is one goal an attacker pursues once an injection succeeds, not a separate category with its own fix.
• Teams building a security chatbot or assistant on structured prompts should red team both paths, since jailbreak resistance alone misses most indirect routes.

Which control fits which risk?

1. Users manipulating your chatbot? Use output-level jailbreak detection.
2. Agents reading poisoned content? Use injection-specific input governance.
3. Both at once? Use both layers, not one stretched to cover the other.

How to Prevent Prompt Injection: A Layered Defence

No single control eliminates this risk, and any vendor promising otherwise has not tested that claim against an adaptive attacker. A multi-layered defense strategy matters, since one bypass should never mean total compromise. NIST's AI Risk Management Framework tracks OWASP LLM01 prompt injection the same way: An owned, tracked risk. 

Architectural Prevention (Least Privilege, Capability Separation)

Caps what an agent can do, so a successful injection has limited reach.

• Capability-based design and least-privilege tool scoping cap the blast radius when an injection succeeds.
• Role-Based Access Control on every tool and data connection limits what a compromised agent can reach.
• Dual-model separation keeps the model handling untrusted content away from the model with confidential data access.

Runtime Detection and Human-in-the-Loop Approval

This runtime defense layer catches what the architecture missed, watching agent behaviour as it happens.

• Behavioral baselines compare the model's responses against normal patterns, flagging anomalous tool calls fast.
• Sensitive data scanning on the response generation process catches confidential information before it leaves.
• Human oversight checkpoints for irreversible actions are the strongest control, and the first teams disable them.
• Lockdown Mode restricts tool access when monitoring flags adversarial behaviors, buying time for review.

Security tools should be evaluated against your own training dataset of real traffic, not just vendor benchmarks. This governance layer plugs into a broader AI governance program, whether an existing AI governance framework or one your team is still building.

How BuildNexTech Helps You Build Prompt-Injection-Resilient AI Agents

Agentic AI security is our agent orchestration and observability layer built around this exact problem: Tool-call logging, behavioral baselines, and Model Context Protocol visibility across every agent we deploy, with capability-scoped design, Role-Based Access Control, and human oversight checkpoints built in from day one.

We cut manual underwriting effort by 65% for a US digital bank using this approach, keeping every agent action auditable and reversible throughout. Teams choose this over point-solution security tools because the observability is native to the runtime.

What a BuildNexTech Agent Security Implementation Looks Like

• Discovery: Map trust boundaries, run AI red teaming against likely injection paths.
• Integration: Scope credentials and API keys, configure approval gates and Role-Based Access Control.
• Deployment: Enable runtime monitoring and Lockdown Mode triggers.
• Iteration: Tune behavioral baselines against real traffic as your agentic AI era footprint grows.

Teams walk away with a documented trust boundary map and a live action log. That output is what security training and a training program should actually produce, not a slide deck nobody references again.

Who This Is For

This fits organisations running five or more production AI agents with tool or API access, especially where agents touch confidential data. Common triggers include a SOC 2 audit, a new MCP integration, an unexplained agent action, or a Cybersecurity Skills Roadmap that flags agentic AI as a gap.

Conclusion

Prompt injection is structural, not a bug any patch fixes, and it will not disappear as models get better at reasoning. The goal was never full elimination; it was containment: Scoping agents tightly enough that a successful attempt costs little instead of everything.

Teams still defending only against direct chat abuse are already behind, since indirect and agentic prompt injection now dominate today's incident reports. Organisations that treat this as an owned, documented, revisited risk are the ones that catch problems before an attacker does.