Large language models (LLMs) and AI agents are transforming how organizations search for information, automate workflows, and interact with users. However, these capabilities also introduce new security risks. One of the most significant is prompt injection, where attackers manipulate AI systems into ignoring trusted instructions or performing unintended actions. Unlike traditional cyberattacks that exploit software vulnerabilities, prompt injection targets the way AI models interpret language, making it a unique challenge for security teams.

In this blog, we'll explain what prompt injection is, how it works, the different types of attacks, and why modern LLMs are vulnerable.

» Ensure your cybersecurity is up to standard with KELA

Everything You Need to Know About Prompt Injection

In practical terms, this represents social engineering for AI: the attacker manipulates the model rather than directly exploiting traditional software code. The attack can be direct, through user prompts, or indirect, through emails, webpages, documents, and other external content.

» Make sure you understand the most targeted entry points by attackers

How Does Prompt Injection Work?

Prompt injection works by inserting malicious instructions into content that an AI model processes. Instead of following the developer's intended instructions, the model interprets the attacker's input as legitimate guidance and may generate unintended outputs or perform unauthorized actions.

A typical prompt injection attack follows these steps:

1. An attacker embeds malicious instructions in content such as a webpage, email, PDF, document, code repository, or database record.
2. The AI application processes the content, often through Retrieval-Augmented Generation (RAG), web browsing, uploaded files, or another external data source.
3. The model treats the malicious content as part of its prompt, causing it to ignore, override, or manipulate its original instructions.
4. The AI produces unintended behavior, such as exposing sensitive information, bypassing safety controls, misusing connected tools or APIs, or performing unauthorized actions.

The risk is significantly greater for AI agents than traditional chatbots. While a manipulated chatbot may generate incorrect or unsafe responses, a manipulated AI agent can interact with enterprise systems, databases, email platforms, cloud services, and other applications using legitimate credentials.

» Here's everything you need to know about infostealers

Stay One Step Ahead

Secure your LLMs and AI applications with KELA Cyber's AiFort before prompt injection becomes a security incident.

Learn More

How Prompt Injection Differs From Other AI Attacks

Prompt injection is only one type of attack targeting AI systems. While it shares similarities with techniques such as jailbreaks and prompt obfuscation, each attack targets a different layer of the AI ecosystem and requires different defensive strategies.

These distinctions matter because each attack type requires different testing and defenses. Prompt injection assessments should evaluate direct prompts, RAG sources, emails, documents, and other untrusted inputs, while obfuscation testing verifies whether security controls can detect transformed malicious content.

» Did you know? Cybercriminals now exploit generative AI

Principal Types of Prompt Injection Attacks

The principal types of prompt injection attacks include direct, indirect, stored/persistent, multimodal or cross-context, and multi-agent injections. The source of the malicious instruction matters because it determines where defenders should search for evidence and how broadly they should scope an investigation.

• Direct prompt injection: The attacker enters malicious instructions directly into an AI interface to override its intended instructions. Investigators should prioritize user prompts, session histories, account identities, API requests, timestamps, and application logs.
• Indirect prompt injection: The malicious instruction originates from external content such as webpages, emails, PDFs, knowledge bases, or retrieved documents. Investigation must shift toward the data supply chain: identifying the original content source, when it was ingested, which RAG process consumed it, and what downstream actions the AI subsequently performed.
• Stored/persistent injections: Require similar investigation of persistent memory, training data, databases, and reusable knowledge sources because the malicious instruction may affect later sessions.
• Multimodal or cross-context attacks: Extend the attack surface to images, audio, metadata, encoded information, and other non-text inputs. Work on visual prompt injection, and earlier research by Bagdasaryan et al. on abusing images and sounds for indirect instruction injection, identifies multimodal injection as malicious instructions embedded in images, audio, or other non-textual content.
• Multi-agent attacks: Go further by allowing poisoned outputs from one AI agent to become input for another, potentially spreading manipulation across an automated workflow.

A systematic review in Computers, Materials & Continua, covering 128 peer-reviewed studies published between 2022 and 2025, found that prompt injection has progressed from simple direct injections to sophisticated multimodal attacks, reaching success rates above 90% against unprotected systems. Defenses narrow that without closing it: input preprocessing achieves 60% to 80% detection rates and architectural defenses reach up to 95% against known patterns, while significant gaps persist against novel attack vectors.

» Learn the difference: Internal vs. external attack surface in cybersecurity

Why Modern LLMs Are Vulnerable to Prompt Injection

Modern LLMs and AI agents are designed to follow natural-language instructions, retrieve external information, and perform tasks autonomously. These same capabilities that make them highly effective also create opportunities for prompt injection attacks.

LLMs Cannot Reliably Separate Instructions From Data

LLMs process system prompts, user inputs, retrieved documents, and contextual information within the same natural-language environment.

Unlike parameterized database queries that enforce strict separation between commands and data, LLMs have no equivalent security boundary. As a result, attacker-controlled content can be interpreted as legitimate instructions.

Semantic and Probabilistic Processing

Rather than matching predefined commands, LLMs interpret language based on meaning, context, and probability. This makes traditional signature-based security controls less effective because attackers can express malicious intent through alternative wording, different languages, encoded text, or role-playing scenarios.

Frontier context windows now run to roughly one million tokens, up from the 128,000 of the GPT-4o generation. OpenAI publishes 1.05 million tokens for its current GPT models, and Anthropic publishes one million for its current Opus and Sonnet models, with 200,000 now the smaller-model tier rather than the ceiling (documentation checked September 2026). Every one of those tokens is space in which a malicious instruction can sit unnoticed.

External Data Retrieval Through RAG

Many AI applications use RAG, web browsing, and uploaded documents to enhance responses. While these capabilities improve accuracy and usefulness, they also create indirect prompt injection pathways by allowing models to process attacker-controlled content without the user's knowledge.

These malicious instructions do not even need to be visible to humans as long as they can be interpreted by the LLM.

AI Agents Can Take Real-World Actions

Modern AI agents extend beyond conversation by interacting with APIs, databases, email systems, and enterprise SaaS platforms.

While a compromised chatbot may simply generate incorrect information, a compromised AI agent can perform unauthorized actions using legitimate credentials.

» Make sure you know the difference between a vulnerability, a threat, and a risk

Broad Permissions Increase the Impact

The potential damage caused by prompt injection depends largely on the permissions assigned to the AI system. When an AI agent has access to multiple enterprise applications, a successful prompt injection can exploit the combined authority of those systems.

Because agents act at machine speed across multiple connected systems, least-privilege access and continuous authorization become essential security controls rather than hygiene.

Autonomous Workflows Expand the Attack Surface

AI agents increasingly plan tasks, select tools, retain memory, and exchange information with other agents. As autonomy grows, a single injected instruction can influence multiple stages of an automated workflow, transforming prompt injection from a model-level issue into a broader enterprise security challenge involving identity, governance, application security, and operational resilience.

» Find out how agentic AI is transforming cybersecurity

Who Is Carrying Out Prompt Injection Attacks?

Current prompt injection activity is better categorized by attacker capabilities and objectives than by traditional Advanced Persistent Threat (APT) groups. While large-scale nation-state campaigns remain limited, the threat landscape is increasingly driven by opportunistic cybercriminals and sophisticated attackers targeting AI-powered applications.

• Opportunistic web attackers: Google reported a 32% increase in malicious indirect prompt injection detections between November 2025 and February 2026. These attackers embed hidden instructions in webpages to manipulate AI-generated responses, recommendations, and search results.
• AI-enabled cybercriminals: Threat actors increasingly combine prompt injection with conventional hacking techniques. In one documented case an attacker jailbroke commercial AI coding assistants under a bug-bounty pretext and turned them against nine Mexican government agencies, logging 1,088 attacker prompts that generated 5,317 AI-executed commands across 34 sessions and exposing hundreds of millions of records between December 2025 and February 2026.
• Attackers targeting AI agents and developer environments: AI coding assistants were the target in seven of the twenty-one promptware incidents documented across 2025 and 2026 (Brodt, Feldman, Schneier and Nassi, February 2026). In February 2026, a prompt injection hidden in a GitHub issue title gave an attacker code execution inside the CI pipeline of Cline, an AI coding assistant with more than five million users. The chain pivoted through GitHub Actions cache poisoning to steal the project's npm and extension-marketplace publishing tokens, then pushed an unauthorized release that installed a second AI agent on every machine that updated during an eight-hour window. Security researcher Adnan Khan disclosed the vulnerability on February 9, 2026 and Cline fixed it within thirty minutes; an unrelated actor exploited it eight days later using a token that had not been correctly revoked (GHSA-9ppg-jx86-fqw7).
• Specialized prompt injection attackers: More advanced operators are using techniques such as prompt obfuscation, multimodal prompt injection, RAG poisoning, and cross-agent attacks. PoisonedRAG showed that as few as five crafted documents per target question can achieve a 90% attack success rate against a RAG knowledge database holding millions of texts (Zou, Geng, Wang and Jia, 2024).

» Make sure you understand how threat actors breach and exploit your data

What Attackers Aim to Achieve

Prompt injection is rarely the end goal. Instead, attackers use manipulated AI outputs to support broader cyberattacks, automate malicious actions, or gain access to sensitive systems and data.

Common objectives include:

• Data theft and sensitive information disclosure
• Credential and system prompt extraction
• Privilege escalation
• Unauthorized tool or API execution
• Fraud and financial abuse
• Misinformation generation
• Persistent compromise
• Manipulation of automated business workflows

» Make sure you understand the difference between leaked credentials and compromised accounts

Real-World Prompt Injection Examples

Several high-profile incidents demonstrate how prompt injection can affect enterprise AI systems.

Anatomy of an AI Agent Attack Chain

Prompt injection often represents just one stage of a broader attack. KELA documented an attack in which the threat actor "TheMekanic" discovered enterprise AI endpoints, manipulated an AI agent through prompt injection, extracted a bearer token, and reused it to bypass authentication.

The attack chain consisted of four stages:

1. AI endpoint discovery – Weak API security exposed enterprise AI endpoints.
2. Prompt injection – Malicious instructions manipulated an AI agent operating with enterprise privileges.
3. Bearer token exposure – The compromised agent revealed machine credentials.
4. Token replay – The attacker reused the token to access enterprise resources.

KELA's Mid-Year AI Threat Landscape Report also identified more than 49,700 active session cookies for major AI services, drawn from a wider population of more than 90 million compromised accounts originating from over one million unique infostealer-infected machines globally between January 1 and May 1, 2026.

» Worried about security? Here are the reasons you need cyber threat intelligence

Stay Ahead of AI Threats

Combine KELA Cyber's Cybercrime Threat Intelligence Platform with AiFort to detect, monitor, and defend against evolving AI threats.

Contact Us

Strengthen Your Defenses Against Prompt Injection

As AI adoption grows, prompt injection is becoming a critical security challenge that requires more than model-level defenses. Organizations need continuous visibility into emerging threats, strong identity controls, and proactive monitoring to reduce the risk of compromised AI applications and agents.

At KELA Cyber, our Cybercrime Threat Intelligence Platform provides real-time insight into leaked credentials, vulnerable services, and attacker activity, enabling security teams to identify risks early and respond before they lead to a breach. Combined with AiFort, which red-teams LLM and AI applications against adversarial prompts before attackers reach them, organizations can test their AI security posture against the techniques described above.

» Ready to begin? Try KELA for free