Prompt Injection: 8 Classes and What Now Stops Each

A language model reads one stream of text. Your system instructions, the user’s question, the document you retrieved, the result your API returned — all of it lands in the same context window with no structural marker saying which part is trusted.

Prompt injection is what happens when an attacker puts instructions into the untrusted part and the model follows them anyway.

The comparison people reach for is SQL injection, and it is half right. Both exploit the mixing of code and data. But SQL has a fix: parameterized queries create a real boundary the database enforces. Natural language has no equivalent. There is no way to escape a sentence.

That difference matters more than any single technique in this article. It means prompt injection is not a defect in a particular model that a vendor will eventually patch out.

Anthropic, Google DeepMind and OpenAI have all published work acknowledging the same thing: this cannot be fully solved at the model layer. Any defense written as a prompt instruction can itself be overridden by a better prompt.

Key Takeaways

• Prompt injection has held the number one spot in OWASP’s Top 10 for LLM Applications for two years running, and it is not a bug that gets patched. It is a consequence of how language models read text.
• Eight distinct prompt injection classes now matter in production. Only one of them arrives through the input box a user types into.
• No single defense covers all eight. Classifiers stop overt attempts and miss camouflaged ones. Architectural controls like CaMeL stop the damage without stopping the injection.
• EchoLeak (CVE-2025-32711, CVSS 9.3) proved zero-click exfiltration works against a shipped enterprise assistant. The theoretical phase is over.
• The practical question in 2026 is not whether prompt injection works. It is how small you can make the blast radius when it does.

Quick Navigation

Why a Prompt Injection Taxonomy Matters Now

Ask a security team what they have done about prompt injection and you will usually hear that inputs run through a classifier. That is not wrong. It is just aimed at roughly one tenth of the problem.

The reason is architectural. When your product was a chatbot, the input box was the attack surface. When your product became an agent that reads email, queries databases, calls third-party APIs and remembers things between sessions, every one of those channels became an instruction channel.

Several good taxonomies already exist. CrowdStrike has cataloged more than 200 named techniques across delivery paths and prompting styles. HiddenLayer published an interactive taxonomy of adversarial prompt engineering. A February 2026 systematization on arXiv reviewed 37 attack papers and organized them by payload generation strategy.

What is genuinely missing is the mapping. Knowing that eleven attack families exist helps you write a report. Knowing which defense stops which family helps you ship.

That mapping is what the rest of the article is for.

The Two Axes Every Prompt Injection Map Needs

Before the eight classes, one structural point that most write-ups skip.

Every prompt injection attack has two independent properties. The first is delivery: how the malicious instruction physically reaches the model’s context. The second is phrasing: how the instruction is packaged once it arrives.

These are orthogonal. Any delivery channel combines with any phrasing style. A blunt override instruction can arrive through a PDF, and so can a subtle one dressed as analyst commentary.

This matters because most defenses only address one axis. Input classifiers watch phrasing. Provenance tracking watches delivery. A team that buys only one has covered half a grid.

The eight classes below are organized by delivery, because delivery is what determines your architecture. Phrasing shows up as the variable that decides whether your detector fires.

Class 1: Direct Prompt Injection

Delivery: the user types it.

This is the original. A user submits input designed to override the system prompt — asking the model to disregard its instructions, reveal its configuration, or adopt a persona without restrictions.

The illustrative shape is the one everybody knows: a request that explicitly instructs the model to set aside prior instructions and reveal what it was told at the start.

Why it still matters: system prompt leakage graduated to its own OWASP category (LLM07) precisely because leaked instructions become the map for every later attack.

Why it matters less than you think: direct attempts account for roughly one in ten production agent incidents. The user is the one party you can already identify, rate-limit and ban.

Class 2: Indirect Prompt Injection via Retrieved Content

Delivery: a document, webpage or email the agent reads on the user’s behalf.

Greshake and colleagues demonstrated this in 2023 with hidden text on a webpage. It is now the dominant real-world class.

The shape: text styled to be invisible to a human reader — white on white, zero-size font, an HTML comment — placed in a document the assistant will summarize. The text reads as an administrative instruction rather than content.

The reproducible case: EchoLeak, CVE-2025-32711, CVSS 9.3. A crafted email arrived in a Microsoft 365 Copilot user’s inbox. When the user later asked Copilot to summarize their mail, the assistant followed the embedded instructions and exfiltrated tenant data. Zero clicks. No link for the victim to avoid.

The victim never typed anything malicious. They received an email, which is not a behavior you can train out of your workforce.

Now in the wild: Unit 42 documented large-scale indirect prompt injection campaigns in March 2026, including ad-review evasion and system prompt leakage on live commercial platforms.

Class 3: Tool Output Prompt Injection

Delivery: the response body of an API or function the agent called itself.

Your agent calls a weather service, a CRM lookup, a ticketing API. The response comes back and goes straight into context.

Nobody sanitizes it, because the agent chose to make that call. The call was legitimate. The response is attacker-controlled if the attacker controls any field in the record being returned.

The shape: a free-text field in a returned record — a customer note, a ticket description, a product review — containing instructions rather than data.

This is the fastest-growing class as agents chain third-party APIs. It is also the one most often missed in threat models, because teams reason about tools as things the agent uses rather than things that talk back.

Class 4: Tool Description and MCP Poisoning

Delivery: the metadata describing a tool, loaded at connect time.

When an agent connects to a Model Context Protocol server, it pulls each tool’s name, description and parameter schema into context so the model knows what is available. That metadata is rarely rendered in the UI. It is fully visible to the model.

Invariant Labs named this a Tool Poisoning Attack in 2025. OWASP now documents it directly, and the Cloud Security Alliance describes three variants: description poisoning, rug-pull attacks where a tool changes after approval, and shadowing where a malicious server’s description hijacks behavior on a different server.

What makes this class different is persistence. A document-based injection has to be delivered again each time. A poisoned tool description ships inside a package or a configuration file and fires on every invocation, in every session, for every user, until somebody reads the metadata.

OWASP places this under ASI01, Agent Goal Hijack, in the 2026 Top 10 for Agentic Applications. The root cause is a trust gap: descriptions get reviewed once at connect time, and responses go into context at runtime with no equivalent check.

Class 5: Memory Prompt Injection

Delivery: the agent’s own long-term memory store.

Agents that persist context across sessions can be taught something false today that they act on next week.

The shape: content in one session that the agent summarizes into memory as a durable preference or standing instruction. The attacker’s payload becomes part of what the agent believes about the user.

Researchers demonstrated persistent memory poisoning in Amazon Bedrock agents that survives session boundaries. MITRE ATLAS added agent-specific techniques for context poisoning and memory manipulation in October 2025.

This converts a one-shot exploit into a durable backdoor. Session-scoped defenses do nothing, because the attack has already left the session.

Class 6: Agent-to-Agent Prompt Injection

Delivery: a message from another agent in a multi-agent system.

Agents pass rich natural-language instructions to each other with none of the schema validation or authentication that governs API calls between services.

A compromised or manipulated subagent becomes a trusted upstream source for every agent downstream of it. Privilege inherits across the boundary without validation.

The shape: an orchestrator receives a summary from a research subagent, and that summary contains an instruction the subagent absorbed from a poisoned webpage. The orchestrator has no way to tell analysis from directive.

This class did not exist before multi-agent architectures. It is the reason MCP security guidance now treats the agent control plane as its own security domain rather than an application concern.

Class 7: Multimodal and Encoded Prompt Injection

Delivery: any channel, but obfuscated to defeat pattern matching.

Two related tricks sit here.

Multimodal: instructions embedded in an image the model reads via OCR, or in a screenshot, or in document metadata. Text the human eye skips and the vision encoder does not.

Encoded: the same instruction expressed in base64, in unusual Unicode, with homoglyph substitutions, or split across tokens. The intent survives. The string match does not.

Real-world ad-review bypass using CSS-hidden injections has been observed in production. The defensive point is that this is a phrasing technique layered onto any of the delivery classes above, not a separate delivery path — which is exactly why keyword-based detection ages badly.

Class 8: Domain-Camouflaged Prompt Injection

Delivery: any channel, phrased as legitimate domain content.

This is the class that breaks most classifiers, and the least discussed.

Standard injections use explicit override language that syntactic detectors reliably flag. Camouflaged injections do not instruct at all. They assert — using the authoritative vocabulary of the domain, in a register indistinguishable from the surrounding document.

The shape: a paragraph appended to a financial document, headed as supplementary analyst commentary, stating that a review has revised a recommendation. There is no imperative verb. There is no instruction to ignore anything. There is just a conclusion the model then carries forward.

A June 2026 evaluation found financial-domain deployments facing 26–33% baseline attack success against camouflage-class attacks, with no prompting-based defense eliminating the threat on weaker models. defense effectiveness proved strongly model-dependent: spotlighting halved attack success on Claude Haiku while providing no measurable benefit on Llama 3.1 8B.

That last finding deserves emphasis. A defense that works on your evaluation model may do nothing on the model you deploy.

Which defense Blocks Which Prompt Injection Class

Here is the mapping. Read it as coverage, not as guarantees.

Class	Input classifier	Spotlighting	Provenance / taint tracking	Capability limits + egress control	Human approval
1. Direct	Strong	Weak	Weak	Moderate	Moderate
2. Indirect / retrieved	Moderate	Strong	Strong	Strong	Moderate
3. Tool output	Weak	Moderate	Strong	Strong	Moderate
4. MCP / tool description	Weak	Weak	Moderate	Strong	Strong
5. Memory	Weak	Weak	Strong	Moderate	Weak
6. Agent-to-agent	Weak	Moderate	Strong	Strong	Weak
7. Multimodal / encoded	Weak	Moderate	Strong	Strong	Moderate
8. Domain-camouflaged	Very weak	Moderate	Moderate	Strong	Strong

Three patterns fall out of this table.

Input classifiers cover one column well. They catch overt phrasing at the front door and degrade sharply everywhere else. Class 8 is where they fail hardest, because there is no attack syntax to detect.

Spotlighting is cheap hygiene, not a control. It marks untrusted content with delimiters or control tokens so the model can tell data from instruction. Google’s Gemini team uses a control-token variant to avoid disrupting semantic flow. It measurably reduces attack success and requires no retraining. It is also probabilistic and model-dependent.

Architectural controls are the only thing that scales across all eight. CaMeL, from Google DeepMind, splits work between a privileged model that plans and a quarantined model that reads untrusted content without tool access. A custom interpreter tracks provenance through the execution graph and gates every tool call against a capability policy.

The insight there is old. It is a reference monitor enforcing policy at the point an action takes effect, which security has done since the 1970s. FIDES, Progent, RTBAS and FORGE apply the same move differently.

One caveat worth carrying: a June 2026 adaptive evaluation warns that out-of-band defenses reporting near-elimination on static benchmarks are being validated by the same methodology that already failed for in-band defenses. Strong AgentDojo numbers are not the same as strong numbers against an adaptive attacker.

Building a Prompt Injection Test Suite

Turning the taxonomy into something operational takes four steps.

Enumerate your channels first. For each agent, list every path by which text reaches the context window. Most teams find between six and twelve. If your list has one entry, you have listed the input box and missed the rest.

Write one test per class per channel. You are not trying to invent novel attacks. You are confirming that a known class fails safely on your surface.

Measure blast radius, not block rate. The useful metric is what the agent could do once injected, not how often the injection was caught. An agent that can read files and make outbound HTTP requests is a far worse outcome than one that returns text.

Constrain egress. If injected instructions cannot reach an attacker-controlled endpoint, most exfiltration classes fail even when the injection succeeds. This is the highest-leverage control on the list and the one most often skipped.

Teams already mapping their broader exposure will find this maps cleanly onto the five layers of the AI attack surface. Classes 3 through 6 only exist in systems with agency, which is worth reading alongside the difference between agentic and generative AI. And for classes 4 and 8, where automated detection is weakest, the approval gate is doing the real work — a case covered in more depth in why human-in-the-loop is becoming a core AI pattern.

Frequently Asked Questions

Keep reading

Here are the latest posts from the blog.