Structured-output smuggling in JSON mode
Forcing JSON output does not stop injection; attacker content can populate fields that downstream code executes or trusts.
Tag: prompt-injection
Prompt injection in code assistants through comments
AI coding tools ingest repo files as context, so a crafted comment or config can steer generated code toward a backdoor.
Poison shared few-shot templates
If example sets or prompt templates are user-contributed or fetched at runtime, a poisoned example becomes a persistent instruction.
Hide injections in invisible Unicode tag characters
Unicode tag block characters are invisible to humans but tokenized by many models, letting you smuggle instructions into visible text.
Persistent injection via RAG index poisoning
Anything you can write that later gets embedded becomes a stored injection that fires whenever a similar query retrieves it.
Coerce dangerous tool calls in agentic systems
Rank agent findings by the blast radius of the tool, then craft content that makes the agent invoke it and hide the action.
Zero-click data exfiltration via markdown image rendering
If the client renders markdown images, an injected instruction encodes secrets into an image URL the victim's browser fetches automatically.
Indirect prompt injection through retrieved documents
The real attack surface of an agent is the content it ingests, not the chat box; plant instructions in data it will retrieve.