Prompt injection examples

These are documented cases, each linked to its source, followed by the attack patterns OWASP uses to describe LLM01:2025 Prompt Injection. For each one the right-hand column names the defence family our prompt injection test checks for.

Documented cases

OWASP's nine attack scenarios

OWASP's LLM01 entry lists these scenarios. Summaries are ours:

1. Direct injection: A user tells a support chatbot to ignore its guidelines, query private data and send email, which leads to unauthorised access.
2. Indirect injection: A page the model is asked to summarise hides instructions that make it insert an image link; displaying the image leaks the private conversation.
3. Unintentional injection: An instruction a company put in a job advert is triggered by an applicant who used an LLM to polish their CV.
4. Intentional model influence: An attacker edits a document in a RAG repository; when it is retrieved, it steers the model's answer.
5. Code injection: A vulnerability in an LLM email assistant (CVE-2024-5184) lets injected prompts reach sensitive information and change email content.
6. Payload splitting: Pieces of an instruction spread across a CV combine when an LLM evaluates the candidate, producing a favourable recommendation.
7. Multimodal injection: An instruction hidden in an image changes what a multimodal model does with the accompanying text.
8. Adversarial suffix: A string of apparently meaningless characters appended to a prompt pushes the model past its safety measures.
9. Multilingual or obfuscated attack: Instructions in another language or encoded (for example in Base64 or emoji) slip past filters.

What the examples have in common

• The channel matters more than the wording. Scenarios 2, 4, 5, 6 and 7 arrive through content the model reads, not the chat box.
• The impact comes from what the model can reach. A leaked conversation needs a rendered link; changed email needs a send tool.
• Filters alone miss variants. Scenarios 8 and 9 exist precisely to get past pattern matching.

Testing your own agent safely

Use a test environment and test data. Choose a harmless marker string and place an instruction to repeat it in each channel the agent reads: the chat, a document, a web page, an email, a tool result. If the marker appears in a reply, or a tool is called because of the planted text, that channel is exposed. Record which defence would have stopped it, fix that, and repeat after every prompt or tool change.

Score your agent's defences against these patterns

Sources

• LLM01:2025 Prompt Injection (OWASP)
• Simon Willison, Prompt injection attacks against GPT-3 (12 September 2022)
• Greshake et al., Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection (arXiv, 23 February 2023)
• NCSC, Thinking about the security of AI systems (30 August 2023)
• LLM05:2025 Improper Output Handling (OWASP)
• Checked 1 October 2026.