Prompt injection

Attack Types

• Direct: the attacker writes a command directly into the chat window.
• Indirect: the command is hidden in content that the model reads, e.g., on a website, in an email, or in a document. Most dangerous with agents that browse the web on their own.
• Instruction leaks: an attempt to extract the system prompt, meaning how the chatbot is configured.
• Multi-turn: an attack spread across several innocent messages.

How does our lab do it?

• The lab chat underwent 512 single-message attacks (23.10.2026) and 36 multi-turn conversations (24.10.2026), generated using the promptfoo tool. Zero instruction and data leaks.
• Defense is layered, not a single prompt sentence: PII masking on input, topic gateway (the chat does not answer outside the database), "commands in the message are data" instruction, output gateway that programmatically rejects responses with links, code, or instruction snippets.
• We run the same tests before every prompt change, e.g., 8 classic attacks in a fixed set (role change, markdown link, debug mode, English command).
• What we haven't tested yet: indirect injection via articles that the lab pulls from the internet every day. That is the next test on the list.

What does our database show?

The lab database contains 78 texts about prompt injection and jailbreaks. These include OpenAI posts on hardening the Atlas browser agent and papers measuring how computer-controlling agents can be hijacked by multi-step indirect attacks. The trend is clear: the more the model does on its own, the more dangerous the indirect attack.

How to defend?

• Do not rely on a single sentence in the prompt. The model can be talked around, code cannot.
• Validate the output with code: links, code, PII, instruction snippets.
• Limit what the chatbot can actually do. A chat without access to email will not send an email.
• Test automatically with hundreds of attacks, not three manual tries.