Direct injection, indirect injection through retrieved content, MCP tool poisoning, memory-instruction injection across sessions, and the trust-boundary failures that make each one work. Pattern reference plus original research on novel chains.
Prompt injection is the fundamental exploit class in large language model systems. At its core, the attack exploits a single architectural flaw: LLMs cannot reliably distinguish between developer-authored instructions and user-supplied data. Every input — system prompt, user message, retrieved document, tool output — arrives as the same undifferentiated token stream. An attacker who controls any segment of that stream controls the model's behavior. This is not a bug that gets patched. It is a structural property of how transformer-based language models process sequences. For foundational definitions, see the prompt injection concept page in the wiki.
The attack splits into two operationally distinct categories. Direct injection occurs when an attacker supplies adversarial instructions through the primary input channel — the chat interface, an API parameter, a form field. The attacker has real-time access to the prompt and manipulates the model directly. Jailbreaks, role-play overrides, and instruction-hierarchy escapes all fall here.
Indirect injection is operationally more dangerous and harder to detect. The adversarial payload is planted in content the model will retrieve during execution — a web page, a document in a knowledge base, an email, a calendar entry, a database record. The user never sees the payload. The model ingests it as trusted context and follows the embedded instructions. This turns every data source an AI agent can access into an attack surface. For detailed breakdowns of both categories with real exploit chains, see the prompt injection examples collection and the indirect prompt injection wiki entry.
The Model Context Protocol and similar tool-integration layers amplify prompt injection from a conversation-level nuisance to a system-level threat. When an LLM can read files, execute code, call APIs, send messages, and modify databases, a single injected instruction triggers actions with real-world consequences. MCP creates injection vectors at every layer: tool descriptions carry hidden instructions (tool poisoning), server responses embed adversarial payloads, and cross-server interactions create transitive trust chains that an attacker can exploit without ever touching the primary conversation. A compromised MCP server does not need to attack the model directly — it poisons the tool output, and the model follows. Our MCP threat analysis maps these chains end to end.
Traditional prompt injection is ephemeral — it dies when the conversation ends. Memory injection changes the calculus. When AI systems persist user preferences, custom instructions, or conversation summaries across sessions, an attacker can embed instructions that survive context resets. The attack pattern: inject a payload that the model writes into its own memory store. Every future session loads the poisoned memory as trusted context. The implant persists, self-reinforces when the model summarizes its own context, and resists manual cleanup because the user cannot distinguish legitimate memory entries from injected ones. Our research on memory injection through nested skills demonstrates a complete persistence chain — from initial injection through skill-layer abuse to a self-healing cross-session implant.
The root cause — instruction-data conflation — is not a missing filter or an insufficient guardrail. It is a consequence of how autoregressive language models process sequences. The model treats every token as equally valid context. There is no type system, no privilege level, no hardware-enforced boundary between instruction and data. Every proposed mitigation — input filtering, output monitoring, prompt hardening, instruction hierarchy — reduces attack surface without eliminating it. Determined adversaries consistently find bypasses because the defense must be perfect across every possible token sequence, while the attacker needs only one sequence that works.
Within the Adversarial AI Threat Modeling Framework (AATMF), prompt injection maps to T1: Prompt & Context Subversion — the tactic covering all techniques that manipulate model behavior through input manipulation. The framework decomposes T1 into sub-techniques spanning direct injection, indirect injection, context window manipulation, and instruction hierarchy attacks. This taxonomy provides a structured approach to threat modeling AI systems and mapping adversarial prompting techniques against defensive controls.