Prompt-Injection.net
ENDE
PROMPT-INJECTION.NET

Prompt Injection Security, Red Teaming & Defense

A specialist knowledge platform for understanding prompt injection attacks, testing LLM and AI agent systems, and building effective detection and defensive controls.

Explore the knowledge base

01Core domains

Learn

Build a precise mental model of instructions, context and trust boundaries.

Browse section

Attacks

Study direct, indirect and emerging prompt injection vectors.

Browse section

Defense

Design layered controls for LLM applications and AI agents.

Browse section

Labs

Prepare to test security concepts in controlled demonstrations.

Browse section

Testing

Evaluate real application boundaries with explicit evidence and local pass criteria.

Browse section

Playground

Attack a live AI mail assistant with one email and watch each defense level hold or fail.

Browse section
02Attack paths

Direct vs. Indirect Prompt Injection

The distinction depends on how attacker-controlled instructions reach the model context.

DIRECT

Direct Prompt Injection

Direct input path
UntrustedAttacker
UntrustedUser Input
SystemLLM

An attacker supplies instructions through the application's intended user-input channel.

Read the foundation
INDIRECT

Indirect Prompt Injection

Indirect content path
UntrustedAttacker
UntrustedExternal Content
SystemRAG / Tool
SystemLLM

Attacker-controlled instructions arrive through external content that a system retrieves or processes.

Read the foundation
03Attack taxonomy

Explore the Attack Surface

Prompt injection can enter through multiple content and interaction channels. Each area links to its published article.

Explore attack patterns
04Agency and impact

Why Prompt Injection Matters for AI Agents

A chatbot primarily produces text. An agent may also interpret tool metadata, process tool output, and interact with data or external systems.

Traditional chatbot

Text generation path
  1. User
  2. LLM
  3. Text response

AI agent

Agent execution path
  1. User / External Content
  2. LLM Agent
  3. Tools / Data / External Systems

Agency changes the impact model: manipulated model behavior may influence tool selection, parameters, data access, or external actions. Security controls must therefore extend beyond the prompt and model output.

05Defensive architecture

Defense in Depth

Prompt injection resilience depends on layered controls across content handling, model execution, authorization, and monitoring.

Explore defensive architecture
  1. 01
    Treat external content as untrusted

    Apply the same assumption to user-controlled and externally retrieved content.

  2. 02
    Preserve provenance and trust labels

    Carry source and trust context through the processing pipeline.

  3. 03
    Limit authority with least privilege

    Expose only the tools and data required for the current task.

  4. 04
    Validate tool calls and parameters

    Check requested operations against explicit application constraints.

  5. 05
    Enforce authorization outside the model

    Keep access decisions in deterministic application controls.

  6. 06
    Require human approval

    Add review before consequential or difficult-to-reverse actions.

  7. 07
    Monitor agent behavior and tool chains

    Record and inspect decisions, calls, results, and policy violations.

06Evidence base

Latest Research

Curated, source-backed research summaries covering foundational papers, benchmarks, datasets and systematic reviews.

Browse section

Recent Incidents

Source-backed case records covering disclosed vulnerabilities, research demonstrations, red-team findings and vendor advisories, each with an explicit evidence classification.

Browse section
07Reference frameworks

Standards & References

The knowledge base connects reviewed guidance and terminology to established security frameworks where the relationship is supported by sources.

  • Reference areaOWASP GenAI Security

    Community guidance for security risks in generative AI systems.

  • Reference areaNIST

    Risk management and cybersecurity guidance relevant to AI systems.

  • Reference areaMITRE ATLAS

    A knowledge base for adversarial threats and techniques involving AI systems.

Open the glossary