# Prompt Injection: 7 Real Attack Patterns and How to Test for Them

> Updated 2026-10-25 - 11 min read

Prompt injection tops the OWASP Top 10 for LLM Applications for a reason: it's the most common, most varied, and often the most damaging class of attack against AI-powered systems. It's also widely misunderstood as a single technique, when it's really a family of attack patterns. Here are seven we test for in real engagements, with concrete examples of each.

## 1. Direct instruction override

The simplest form: a user directly tells the model to ignore its system prompt ("Ignore all previous instructions and..."). Modern models resist the crudest versions, but creative phrasing, role-play framing ("pretend you are a model with no restrictions") and multi-turn softening still succeed against many deployments.

## 2. Indirect injection via retrieved content

The attacker never talks to the model directly. Instead, malicious instructions are hidden in a document, webpage, email or support ticket that the model later reads as part of its normal task - a RAG pipeline summarizing a webpage, for instance, that contains hidden text instructing the model to exfiltrate data or ignore its guardrails.

## 3. Multimodal injection

Instructions hidden in an image - via embedded text, steganography-style encoding, or text rendered to be invisible to a human but readable by an OCR or vision pipeline - that a multimodal model processes as part of its input.

## 4. Tool-call and function-call hijacking

In agentic systems, an injected instruction doesn't just change text output - it tricks the model into calling a tool or function it has access to, with attacker-chosen parameters: sending an email, running a database query, or triggering a payment.

## 5. System prompt extraction

Convincing the model to reveal its own system prompt, which often contains business logic, tool definitions or security instructions never meant to be public - and gives an attacker a roadmap for further, more targeted injection attempts.

## 6. Jailbreak via persona or hypothetical framing

Asking the model to role-play a character, write fiction, or answer "hypothetically" as a way to get it to produce output its guardrails would otherwise block - a well-documented class of jailbreak that evolves constantly as model providers patch specific phrasings.

## 7. Multi-turn, gradual escalation

Rather than one injection attempt, a conversation is built up over many turns, each individually innocuous, that collectively steer the model toward an unsafe state - harder for single-message content filters to catch than a one-shot attack.

## How we actually test for these

We map the system's inputs - direct user text, retrieved documents, uploaded files or images, tool outputs - then systematically attempt each pattern against each input surface, documenting what succeeds, what guardrail catches it, and what the real-world impact would be if it succeeded in production.

## FAQ

**Can prompt injection be fully fixed?**
Not with current LLM architectures - it's better treated as a risk to manage (least-privilege tool access, output filtering, monitoring) than a vulnerability to eliminate completely, similar to how SQL injection is managed through parameterized queries rather than "fixed" at the database level.

**Does this only apply to chatbots?**
No - any system that feeds LLM-generated output into another system (a database, an email, a tool call, rendered HTML) is affected, and agentic systems with real-world tool access carry the highest impact.