Direct Prompt Injection
UntrustedAttacker
UntrustedUser Input
SystemLLM
The attacker supplies competing instructions through an intended user-input channel.
View foundationPrompt injection attacks
Prompt injection can enter model context directly through user input or indirectly through external content. This hub organizes the attack surface by interaction pattern, content source and affected system.
Indirect Prompt Injection
UntrustedAttacker
UntrustedExternal Content
SystemRAG / Tool / Agent
SystemLLM
Instructions reach the system through external content it retrieves, reads or processes.
View foundation| Characteristic | Direct | Indirect |
|---|---|---|
| Source | User input | External content |
| Path | Immediate | Via data or tool path |
| Primary boundary | Input channel | Content processing |
Attack taxonomy
Attack knowledge areas
The published taxonomy groups the attack knowledge by interaction and entry path, external content vector, agent and tool path, advanced and lifecycle pattern, and security objective. Every entry leads to a published article.
Interaction patterns
External content vectors
- Published foundationWebsite Prompt Injection
- Published foundationEmail Prompt Injection
- Published foundationDocument Prompt Injection
- Published foundationPDF Prompt Injection
- Published foundationRAG Prompt Injection
- Published foundationSearch Result Prompt Injection
- Published foundationSource Code Prompt Injection