LLM Prompt Injection — Technique & Defense Catalog

Prompt injection is the OWASP #1 vulnerability for LLM applications (2025). Unlike SQL injection — which has had parameterized queries as a solved defense for two decades — prompt injection exploits a fundamental architectural limitation: LLMs process instructions and data as a single flat stream of text tokens with no privilege boundary between them. There is no PREPARE statement for natural language. Defender instructions and attacker payloads compete in the same context window, and the model resolves the conflict through statistical pattern matching, not access control.

This skill catalogs 40+ tested techniques, defense patterns observed in production systems, and real-world case studies where prompt injection produced data exfiltration, identity takeover, and financial fraud.

When to Use

• Target exposes a chatbot, copilot, or AI-backed endpoint (serverless function wrapping an LLM API).
• Response includes metadata like context_length, response_length, or token counts — passive measurement vector.
• Standard jailbreak prompts ("ignore previous instructions") are blocked — model has explicit refusal training.
• Target uses RAG (retrieval-augmented generation), agentictools, or multi-modal inputs — wider injection surface.
• You need to map system prompt contents without backend source access.

Prerequisites

• python3 with requests library.
• Endpoint URL accepting JSON payload with message and optional conversationHistory, entity data fields, language.
• Low rate-limit tolerance: space requests 2-5s apart.