Cybersecurity Compliance
Prompt Injection: 7 Real Attack Patterns and How to Test for Them
Prompt injection tops the OWASP Top 10 for LLM Applications for a reason: it's the most common, most varied, and often the most damaging class of attack against AI-powered systems. It's also widely misunderstood as a single technique, when it's really a family of attack patterns. Here are seven we test for in real engagements, with concrete examples of each.
1. Direct instruction override
The simplest form: a user directly tells the model to ignore its system prompt ("Ignore all previous instructions and..."). Modern models resist the crudest versions, but creative phrasing, role-play framing ("pretend you are a model with no restrictions") and multi-turn softening still succeed against many deployments.
2. Indirect injection via retrieved content
The attacker never talks to the model directly. Instead, malicious instructions are hidden in a document, webpage, email or support ticket that the model later reads as part of its normal task - a RAG pipeline summarizing a webpage, for instance, that contains hidden text instructing the model to exfiltrate data or ignore its guardrails.
3. Multimodal injection
Instructions hidden in an image - via embedded text, steganography-style encoding, or text rendered to be invisible to a human but readable by an OCR or vision pipeline - that a multimodal model processes as part of its input.
4. Tool-call and function-call hijacking
In agentic systems, an injected instruction doesn't just change text output - it tricks the model into calling a tool or function it has access to, with attacker-chosen parameters: sending an email, running a database query, or triggering a payment.
5. System prompt extraction
Convincing the model to reveal its own system prompt, which often contains business logic, tool definitions or security instructions never meant to be public - and gives an attacker a roadmap for further, more targeted injection attempts.
6. Jailbreak via persona or hypothetical framing
Asking the model to role-play a character, write fiction, or answer "hypothetically" as a way to get it to produce output its guardrails would otherwise block - a well-documented class of jailbreak that evolves constantly as model providers patch specific phrasings.
7. Multi-turn, gradual escalation
Rather than one injection attempt, a conversation is built up over many turns, each individually innocuous, that collectively steer the model toward an unsafe state - harder for single-message content filters to catch than a one-shot attack.
How we actually test for these
We map the system's inputs - direct user text, retrieved documents, uploaded files or images, tool outputs - then systematically attempt each pattern against each input surface, documenting what succeeds, what guardrail catches it, and what the real-world impact would be if it succeeded in production.
Need help with this in practice?
A5 Cyber Nexus audits, remediates and certifies against these frameworks.
Frequently asked questions
Can prompt injection be fully fixed?
Not with current LLM architectures - it's better treated as a risk to manage (least-privilege tool access, output filtering, monitoring) than a vulnerability to eliminate completely, similar to how SQL injection is managed through parameterized queries rather than "fixed" at the database level.
Does this only apply to chatbots?
No - any system that feeds LLM-generated output into another system (a database, an email, a tool call, rendered HTML) is affected, and agentic systems with real-world tool access carry the highest impact.
Make it accessible.
Make it attack-ready.
Prove both before launch.
Bring us your app, audit deadline, or security concern. We'll map the fastest path to WCAG conformance, VAPT coverage, and regulator-ready evidence.
