Prompt injection is an attack in which text an LLM reads changes what it does, against the intent of the people who built or use the system [1, 3]. In an agent, that text can arrive in a user's message or inside a web page, an email, a file or a tool result, and the attacker then acts with whatever privileges the agent holds [6]. Prompt injection testing measures how often planted instructions change an agent's actions, channel by channel, and what those actions reach [9, 22].
The guidance cited here offers no method that removes the risk. NIST wrote in March 2025 that current mitigations do not offer full protection [3], and the UK NCSC wrote in December 2025 that no product or appliance fully mitigates it [8]. A test result is a measurement of one agent, on one model version, against a defined set of attacks.
Why prompt injection works
An LLM receives the developer's instructions, the user's request and any retrieved content as one stream of text. NIST's taxonomy says generative models "combine the data and instruction channels", so whoever controls data the system reads can affect what it does [3]. The UK NCSC makes the same point: an LLM enforces no security boundary between instructions and data inside a prompt [8].
Simon Willison named the attack in September 2022 and compared it to SQL injection [15]. In April 2023 he added that parameterized prompts are extremely difficult, perhaps impossible, to build on current LLM architecture [15], and the UK NCSC wrote that prompt injection may never be mitigated the way SQL injection can be [8]. A 2026 paper, "Prompt Injection as Role Confusion", found that models judge the source of text by how it sounds, so a command in a web page that reads like a user's words can hijack an agent despite its tool label [35].
Direct and indirect prompt injection, with examples
In a direct prompt injection, the user's own input carries the instruction [1, 3]. In an indirect one, a third party plants it in content the system reads later, and the primary user is often the one harmed [3]. MITRE ATLAS lists indirect injection through documents, emails, databases and websites, often hidden or obfuscated from the user, for example as invisible text, and since November 2025 also triggered injection, set off by a user action or an event in the victim's environment [6]. OWASP notes that an injection need not be visible to a person as long as the model parses it [1].
Disclosed cases show the indirect route reaching real data. CVE-2025-32711, published in June 2025, is an injection flaw in an enterprise assistant that let an unauthorized attacker disclose information over a network [11]. OWASP's agentic list describes it as a zero-click attack in which a crafted email led the assistant to exfiltrate confidential emails, files and chat logs [2]. In May 2025, Invariant Labs showed a malicious issue in a public repository steering an agent, working through an MCP server at its owner's request, into leaking private repository data in a public pull request [13]. The MCP access control article covers the controls around such servers.
On the open web, a scan of Common Crawl snapshots published in April 2026 found that a naive search mostly turned up harmless text such as teaching material, that the injections it confirmed were mostly pranks, guidance, search engine manipulation or attempts to deter agents, and that the malicious category rose by 32% in relative terms between November 2025 and February 2026 [14].
Prompt injection and jailbreaking
OWASP notes that the two terms are often used interchangeably, and it treats jailbreaking as a form of prompt injection in which input makes the model disregard its safety protocols entirely [1]. For an agent, the concern goes past one answer. OWASP's agentic list sets LLM01:2025, which covers a changed model response, apart from ASI01 Agent Goal Hijack, where manipulated inputs redirect an agent's goals, planning and multi-step behavior [2].
What defenses show under test
Defenses lower measured attack rates and leave some attacks working. In AgentDojo, a 2024 benchmark of 97 agent tasks and 629 security cases, the attacker's goal was met in 57.69% of cases against one model with no defense, using the paper's strongest attack [22]. A prompt injection detector cut that to 7.95% and also cut the model's success on benign tasks from 69.0% to 41.49%, and a tool filter cut it to 6.84% [22].
Adaptive attacks change the picture. In tests published in January 2025, NIST's Center for AI Standards and Innovation (CAISI) and the UK AI Security Institute built attacks on some AgentDojo tasks and tested them on held-out ones [5]. Attack success rose from 11% for the leading baseline attack to 81% for the leading new attack [5]. "The Attacker Moves Second", an October 2025 paper, bypassed 12 recent defenses with attack success above 90% for most, although the majority had first reported near-zero rates [26]. In its human red-teaming competition, people defeated every one of 40 challenges [26]. A model developer reported in November 2025 that one browser-using model with improved safeguards was hijacked in 1.4% of adaptive attempts, against 8.0% for the model alone and 7.6% with its earlier safeguards, and that even a rate near 1% still represents meaningful risk [18].
Prompt injection testing: how to test an agent
Start from the threat model. List each channel the agent reads and each action or data store an attacker would want. Willison's lethal trifecta names the combination that lets an injection steal data: access to private data, exposure to untrusted content and a way to communicate externally [16].
Prompt injection test cases
The OWASP cheat sheet asks that each case define its intended security violation or legitimate task, the context it needs and the outcome to observe, with dummy data and sandboxed tool substitutes [9]. For indirect injection, the input goes in the channel under test, because sending it as a user message tests a different boundary [9]. Benign requests run alongside the attacks, in every language the application accepts, so that false positives are measured too [9].
Scoring a prompt injection test suite
Watch each objective on its own. A refusal in the final answer does not undo an action already taken, and a clean answer does not show that no data left through another channel [9].
Score task success and attack success together. AgentDojo reports benign utility, utility under attack and the targeted attack success rate [22]. WASP, a 2025 web agent benchmark, scores diversion from the user's task apart from full completion of the attacker's goal: diversion rates ranged from 17% to 86%, and full completion reached about 17% at most [25].
Repeat and adapt. CAISI found that 25 attempts per attack raised average success from 57% to 80% [5]. CWE-1427 advises running the same case several times and testing again each time a new model is used or its weights change [7]. The agent evaluation metrics article explains pass@k, the chance that at least one of k attempts succeeds, the measure that matches an attacker who needs one success.
Report per objective. The cheat sheet asks for per-case outcomes, the numerator and denominator of each rate, model and defense versions and the number of repeated runs, with a result for each security objective and no combined score [9]. Missing telemetry and errors never count as blocked attacks [9].
Prompt injection testing tools and benchmarks
For test material, NIST names AgentDojo as a framework for agent hijacking, and garak and PyRIT as open-source tools for finding weaknesses in models [3]. InjecAgent and Agent Security Bench add cases for tool-using agents, including memory attacks, BIPIA for indirect injection in general and WASP for web agents [23, 24, 25, 29]. Benchmarks carry flaws of their own, which what agent benchmarks measure sets out, and what to test before an agent buys on your behalf puts injected seller text and repeated attempts on a purchase checklist.
Rillor's agentic security work tests whether instructions sent in a user message or planted in pages, emails, files and tool results change what an agent does, and every run is logged. Rillor tests only systems the client owns or is authorized to test, within a written scope.
What a test result shows and what it leaves open
A pass on a fixed set of cases shows that those attacks failed on that model version. The OWASP cheat sheet says that passing its smoke test does not show resistance to a persistent adversary [9]. None of the sources sets an acceptable attack success rate, and Willison noted that in web application security, catching 95% of attacks is a failing grade [16]. WASP's authors called low end-to-end rates security by incompetence, and in 2025 they judged those limits unlikely to persist [25].
Design limits what a successful injection can do. The Agents Rule of Two, published by a model developer in October 2025, says an agent should hold no more than two of three properties in a session: untrustworthy input, access to sensitive systems or private data, and the ability to change state or communicate externally [17]. A 2025 paper on design patterns constrains an agent after it reads untrusted input, so that the input cannot trigger consequential actions [34]. A test then checks whether those limits hold.
Read the full report
The full report adds the taxonomies, the channels with disclosed cases, dated attack and defense rates, the design patterns, the fields of a test case, the measures to report and all 35 sources.