Sitemap
All pages of Prompt-Injection.net at a glance.
Sections
Test cases
- Prompt Injection Test Case Library
- PI-TST-001 - Direct instruction boundary
- PI-TST-002 - Indirect external-content boundary
- PI-TST-003 - Retrieval relevance vs trust
- PI-TST-004 - Persistent / multimodal context provenance
- PI-TST-005 - Tool output as untrusted data
- PI-TST-006 - Agent proposal vs authorization
- PI-TST-007 - MCP metadata / discovery boundary
- PI-TST-008 - Multi-agent delegated authority
- PI-TST-009 - Least-privilege capability boundary
- PI-TST-010 - Information-flow / egress boundary
- PI-TST-011 - Human approval binding
- PI-TST-012 - Plan-drift and tool-chain telemetry
- PI-TST-013 - Incident evidence and regression
- PI-TST-014 - Indirect email content and mailbox action boundary
- PI-TST-015 - Document and PDF extraction-layer boundary
- PI-TST-016 - Search-result snippet provenance boundary
- PI-TST-017 - Knowledge-base write-path integrity
- PI-TST-018 - Memory write authorization and stored-context provenance
- PI-TST-019 - Single-session multimodal derived-content provenance
- PI-TST-020 - MCP server result attribution and follow-up authorization
- PI-TST-021 - Principal lineage across chained agent handoffs
Testing templates
Learn articles
- What Is Prompt Injection?
- Instructions and Instruction Hierarchies
- Trust Boundaries and Model Context
- Prompt Injection vs Jailbreaking
- System Prompts
- AI Agents and Tool Calling
- RAG and Retrieval
- Why Prompt Injection Is Not Just Input Validation
- Learning Paths
- Foundations (path)
- Indirect Prompt Injection (path)
- RAG (path)
- AI Agents (path)
- Defense in Depth (path)
Attack articles
- Direct Prompt Injection
- Indirect Prompt Injection
- Website Prompt Injection
- Email Prompt Injection
- RAG Prompt Injection
- Document Prompt Injection
- PDF Prompt Injection
- Search Result Prompt Injection
- Source Code Prompt Injection
- Tool Output Injection
- AI Agent Prompt Injection
- Multi-Agent Prompt Injection
- Persistent Prompt Injection
- Multimodal Prompt Injection
- System Prompt Extraction
- MCP Tool Metadata Injection
Defense articles
- Agent Authorization
- Least Privilege
- Information Flow Control
- Human-in-the-Loop
- Data Provenance
- Input / Content Inspection
- Spotlighting / Data Marking
- Prompt Injection Detection
- Output Validation
- Plan Drift Detection
- Tool-Chain Analysis
- Network / Egress Restrictions
- Sandboxing / Containment
- Incident Response
- Adversarial Testing
Labs
- Direct Prompt Injection Basics
- Direct vs Indirect Prompt Injection
- Trust Boundaries and Model Context
- Website Prompt Injection
- Email Prompt Injection
- Document / PDF Prompt Injection
- Search Result Prompt Injection
- RAG Prompt Injection
- Poisoned Knowledge Base
- Retrieval Relevance vs Trust
- Tool Output Injection
- Agent Authorization
- Plan Drift Detection
- Tool-Chain Analysis
- Human Approval
- Data Provenance
- Information Flow Control
- Least Privilege
- Network / Egress Restrictions
- Incident Investigation
Research
- AgentDojo - Dynamic Environment for Agent Prompt Injection Evaluation
- BIPIA - Benchmark for Indirect Prompt Injection Attacks
- CaMeL - Defeating Prompt Injections by Design
- InjecAgent - Indirect Prompt Injection Benchmark for Tool-Using Agents
- The Instruction Hierarchy - Training Models to Prioritize Privileged Instructions
- Not What You've Signed Up For - Indirect Prompt Injection (Greshake et al.)
- Systematic Review of Prompt Injection Defenses (2026)
- Tensor Trust - Human-Generated Prompt Injection Dataset
Incidents & cases
- EchoLeak - Microsoft 365 Copilot
- Slack AI - Data Exfiltration via Indirect Prompt Injection
- GitLab Duo - Remote Prompt Injection and Source Code Exfiltration
- CamoLeak - GitHub Copilot Chat
- SpAIware - ChatGPT Persistent Memory Injection
- Perplexity Comet - Indirect Prompt Injection in an Agentic Browser
- AWS-2025-019 - Prompt Injection Issues in Amazon Q Developer and Kiro
- Invitation Is All You Need - Targeted Promptware Against Gemini