Prompt-Injection.net
ENDE

Incidents & cases

Prompt Injection Incidents and Case Records

A source-backed record library of publicly documented prompt injection vulnerabilities, demonstrations and incidents in real AI products. Every record states what kind of evidence it rests on.

01

Evidence standard

  • Each record is anchored to primary sources: vendor advisories, CVE records or the original researcher disclosure. Supporting sources are labeled as such.
  • Identifiers such as CVE or MITRE ATLAS IDs appear only when verified. External severity scores are shown with attribution; this site assigns no severity of its own.
  • Attack chains are summarized at a high level. Records contain no payloads, bypass techniques or reproduction steps.

Record types

Confirmed incident
Documented malicious exploitation or harm in a production environment.
Disclosed vulnerability
A validated vulnerability disclosed by a researcher, the vendor or a CVE process.
Research demonstration
A controlled demonstration showing that a real system can be manipulated.
Red-team finding
A responsible-disclosure or red-team finding against a real product.
Vendor advisory
A security advisory or product notice authored by the vendor.

Record library

Newest public disclosure first. Filter by record type, attack class or delivery vector.

Showing 8 of 8 records

  1. Red-team finding - Indirect prompt injection

    CamoLeak - GitHub Copilot Chat

    Red-team finding by Legit Security: attacker-controlled pull request content could influence another user's GitHub Copilot Chat responses and, in the research demonstration, exfiltrate secrets and source code from private repositories. According to the researcher disclosure, GitHub fixed the path by disabling image rendering in Copilot Chat.

    Public disclosure
    2025-10-08
    Vendor / product
    GitHub / GitHub Copilot Chat
    Delivery
    Repository content
    Demonstrated impact
    Influenced Copilot responses for another user and a research-demonstrated path to exfiltrate private code and secrets
    In the wild
    No in-the-wild exploitation reported in cited sources
    Remediation
    Remediated (per researcher disclosure)
    Identifiers
    None listed

  2. Vendor advisory - Indirect prompt injection

    AWS-2025-019 - Prompt Injection Issues in Amazon Q Developer and Kiro

    Vendor advisory from AWS: a security bulletin covering prompt injection issues in Amazon Q Developer and Kiro IDE plugins, reported through coordinated vulnerability disclosure. AWS states it released updates that add human-in-the-loop confirmation and recommends upgrading. The bulletin does not report malicious in-the-wild exploitation.

    Public disclosure
    2025-10-07
    Vendor / product
    AWS / Amazon Q Developer and Kiro IDE plugins
    Delivery
    Repository content
    Demonstrated impact
    As described by AWS: commands that could run without confirmation, a metadata exfiltration path that required accepting an injected suggestion, and configuration-based arbitrary code execution in Kiro with stated preconditions
    In the wild
    No in-the-wild exploitation reported in cited sources
    Remediation
    Remediated by vendor
    Identifiers
    Vendor bulletin AWS-2025-019

  3. Red-team finding - Indirect prompt injection

    Perplexity Comet - Indirect Prompt Injection in an Agentic Browser

    Red-team finding by Brave: webpage content processed by Comet's browser agent could steer the agent, acting in the user's authenticated browser, toward sensitive information and actions beyond the page being summarized. Brave's disclosure documents an incomplete remediation state at publication; the current state is not established here. No malicious in-the-wild use was reported.

    Public disclosure
    2025-08-20
    Vendor / product
    Perplexity / Comet
    Delivery
    Web content
    Demonstrated impact
    In the researchers' demonstration, the agent was steered to access sensitive information and act outside the summarized page
    In the wild
    No in-the-wild exploitation reported in cited sources
    Remediation
    Unknown
    Identifiers
    None listed

  4. Research demonstration - Indirect prompt injection

    Invitation Is All You Need - Targeted Promptware Against Gemini

    Research demonstration by Ben Nassi, Stav Cohen and Or Yair: shared content such as calendar invitations could influence Gemini-powered assistants and, in 14 controlled scenarios, trigger other connected capabilities with digital and physical effects. Google's response on the project page states it deployed mitigations. No malicious in-the-wild use was reported.

    Public disclosure
    2025-08-16
    Vendor / product
    Google / Gemini-powered assistants / Gemini for Workspace integrations
    Delivery
    Calendar invite
    Demonstrated impact
    In controlled tests: unintended use of connected tools, data disclosure paths and physical-world effects through connected home automation
    In the wild
    No in-the-wild exploitation reported in cited sources
    Remediation
    Remediated by vendor
    Identifiers
    None listed

  5. Disclosed vulnerability - Indirect prompt injection

    EchoLeak - Microsoft 365 Copilot

    Disclosed vulnerability (CVE-2025-32711): an attacker-authored email could enter Microsoft 365 Copilot's retrieval context and, in the researchers' demonstration, lead to zero-click disclosure of data in Copilot's scope. Microsoft reported no known exploitation.

    Public disclosure
    2025-06-11
    Vendor / product
    Microsoft / Microsoft 365 Copilot
    Delivery
    Email
    Demonstrated impact
    Potential unauthorized disclosure of data in Copilot's scope over the network; zero-click exfiltration path in the researchers' demonstration
    In the wild
    No known in-the-wild exploitation
    Remediation
    Remediated by vendor
    Identifiers
    CVE CVE-2025-32711

  6. Red-team finding - Indirect prompt injection

    GitLab Duo - Remote Prompt Injection and Source Code Exfiltration

    Red-team finding by Legit Security: attacker-controlled project content could steer GitLab Duo Chat's answers for another user and, combined with an HTML output issue, enable a demonstrated path to exfiltrate private source code. According to the researcher disclosure, GitLab remediated the published chain.

    Public disclosure
    2025-05-22
    Vendor / product
    GitLab / GitLab Duo Chat
    Delivery
    Repository content
    Demonstrated impact
    Manipulated Duo answers and a demonstrated path to exfiltrate private source code the victim could access
    In the wild
    No in-the-wild exploitation reported in cited sources
    Remediation
    Remediated (per researcher disclosure)
    Identifiers
    None listed

  7. Red-team finding - Indirect prompt injection

    SpAIware - ChatGPT Persistent Memory Injection

    Red-team finding by Johann Rehberger: untrusted content could make ChatGPT write persistent instructions into its Memory, which then caused data from later chat sessions to leave the macOS app in a controlled demonstration. The researcher states OpenAI fixed it in September 2024. No malicious in-the-wild use was reported.

    Public disclosure
    2024-09-20
    Vendor / product
    OpenAI / ChatGPT macOS app / Memory
    Delivery
    Web content
    Demonstrated impact
    Persistent memory poisoning and continued disclosure of future chat content across sessions in the controlled demonstration
    In the wild
    No in-the-wild exploitation reported in cited sources
    Remediation
    Remediated (per researcher disclosure)
    Identifiers
    None listed

  8. Research demonstration - Indirect prompt injection

    Slack AI - Data Exfiltration via Indirect Prompt Injection

    Research demonstration by PromptArmor: a message in a public Slack channel could be retrieved into another user's Slack AI answer and cause private-channel data to be placed in a link that exfiltrated it when clicked. No malicious in-the-wild use was reported.

    Public disclosure
    2024-08-20
    Vendor / product
    Salesforce (Slack) / Slack AI
    Delivery
    Collaboration message
    Demonstrated impact
    Private-channel data placed into an attacker-controlled link; exfiltration required the victim to click the generated link
    In the wild
    No in-the-wild exploitation reported in cited sources
    Remediation
    Remediated by vendor
    Identifiers
    MITRE ATLAS AML.CS0035
LearnFoundations on model context, RAG and agents.AttacksDirect and indirect attack paths.DefenseLayered controls.LabsControlled exercises without real systems.