Prompt Injection Attack Compendium (2026 Edition)

What it is

The pillar/index page of aisec.blog's prompt-injection coverage — a reference that maps the attack class against OWASP LLM01 and MITRE ATLAS, then links out to deep-dive spokes. The fetched text is truncated mid-sentence in the detection section, so the defenses list is incomplete here.

How it works

The page's organizing contribution beyond a flat attack list is the vector × goal matrix: two axes (direct vs. indirect; and override / exfiltration / action abuse / output manipulation) yielding eight cells. Its central claim for prioritization: indirect + action abuse is the most dangerous and least-defended cell in practice, while direct + instruction-override is the most studied and most patchable. The root cause it stresses is structural — instruction and data share one channel, there is no parser and no reliable cross-model escape character, so the instruction/data boundary is enforced only by training conventions and post-processing.

What to do

The page frames defense as statistical, not eliminable: "You cannot patch your way to zero." Two decision-relevant specifics:

• Input classifiers (Lakera, Rebuff, Prompt Guard, NeMo Guardrails) catch only ~30–60% of attacks depending on tuning — treat them as one layer, not a fix.
• Agent security cannot be retrofitted with prompt-level fixes alone — for tool-enabled agents (the indirect+action case), constrain at the tool/action layer rather than trusting prompt hardening.

For RAG, it flags every retrieved document chunk as a potential payload if HTML/content is piped into context without sanitization.

Caveats

This is an overview/index page, not a mitigation playbook — the concrete defense guidance lives in the linked spokes, and the detection section is cut off in the captured text. The ~30–60% figure is stated without methodology. Several attack patterns are noted as already mitigated in frontier models (authority framing via RLHF; context overflow via larger attention windows), remaining exploitable mainly against fine-tuned open-source or token-limited/older systems.