Advanced Prompt Injection Techniques 2026: 7 Attack Chains

What it is

Part 2 of a practitioner series on prompt injection, structured as a "playbook" of seven attack chains. The catalog summary already names the seven chains, the CaMeL figures, and the source citations. What it does not carry are the quantitative base rates and the specific mechanism detail the post supplies, which is what an engineer weighing risk actually needs.

How it works

Two numbers on this page are not in the summary and change the risk calculus:

• Indirect injection is not a corner case. ReAct-prompted GPT-4 falls to indirect prompt injection 24% of the time in benchmark testing; adding reinforcement prompts nearly doubles that success rate.
• Fine-tuning backdoors are cheap. Poisoning just 0.1% of fine-tuning data — 52 examples — shifts model behavior from 0% to 40% negative responses on a targeted topic. This is the concrete cost of the Virtual Prompt Injection chain the summary only names.

The RAG mechanism is spelled out: the attack surface is every document in the vector DB, not the user prompt. An attacker who inserts or modifies one corpus entry (wiki page, support ticket, code comment, product listing) plants instructions that get retrieved, chunked, and concatenated into the context window beside the legitimate query. Greshake's framing is quoted: processing retrieved content acts as arbitrary code execution.

Preconditions / Affected

The RAG chain requires only write access to any document that can enter the corpus — not access to the prompt or the model. The VPI chain requires influence over fine-tuning data (a supply-chain position). MCP proliferated through Cursor, Claude Desktop, and VS Code Copilot in 2025, which is the exposure surface for the tool-poisoning and rug-pull chains.

What to do

The page states no patches or commands — it is a survey, not an advisory. Its only concrete defensive pointer is architectural: CaMeL (Google DeepMind, March 2025) as the first design with provable guarantees, at a stated 7-point task-completion cost (77% vs. 84% undefended).

Caveats

The fetched text is truncated mid-sentence in the RAG exfiltration section, so the later chains (tool-call exfiltration through DNS/image renders, MCP rug-pulls, cross-agent escalation, Agent Commander) are described only at taxonomy level here — the mechanism detail for those is not in the captured text. This is a secondary-source roundup citing others' CVEs and papers, not original research; treat the metrics as reported, not independently reproduced.