AI vendors are building prompt injection resistance directly into models through training, not just bolting on external filters. Below are techniques attackers use in the real world, organised by category. Anthropic dropped its direct prompt injection metric entirely in its February 2026 system card, arguing that indirect injection is the more relevant enterprise threat (Anthropic, 2026). Data poisoning occurs when pre-training, fine-tuning, or embedding data is manipulated to introduce vulnerabilities, backdoors, or biases. An attacker uses multiple languages or encodes malicious instructions (e.g., using Base64 or emojis) to evade filters and manipulate the LLM’s behavior.
While LLMs are designed to follow trusted instructions, they can be manipulated into carrying out unintended responses through carefully crafted inputs. 📧 A malicious user could manipulate AI reading or summarization agents. The core vulnerability that gives rise to prompt injection attacks lies in what can be termed the “semantic gap”.