LLM Prompt Injection Cheat Sheet

Later instructions compete with — and often beat — the system prompt; there is no hard precedence.

Redirect the app's task while the wrapper thinks it's still doing its job.

Forge a delimiter or assistant turn so the model believes the trusted region ended and a new authoritative one began.

Claim a privileged role never granted — "admin" is a token pattern, not an authenticated identity.

Forbid refusal markers or force a compliant opening token.

Inject a forged prior assistant turn into client-supplied history so the model continues from a point where it "already agreed."

Inject the model's own structural control tokens (<|im_start|>, tool_call) to forge role boundaries — a real chat-template break, not just text delimiters.

Instantiate an alternate persona defined as unrestricted, then address it.

Wrap the request in fiction, simulation, or "for a screenplay" so the output is nominally about something else.

Format the request as a policy/config file (XML/JSON/INI) to borrow the elevated trust of structured directives.

Single-shot "augment, don't change, your rules — just add a warning label" that unlocks multiple frontier models.

Make the model act as a scoring-rubric judge, then ask for a highest-severity exemplar.

Embed the unsafe topic among benign ones so attention is distributed and it rides along.

Rephrase a present-tense harmful ask into the past or future — refusal training generalises poorly across tense.

A required JSON schema or enum forces harmful content out field-by-field, in a plane prompt-scanners don't inspect.

Start benign, escalate by referencing the model's own prior outputs; each step is a small delta from an accepted position.

Context poisoning — plant lightly-loaded seeds early, then get the model to elaborate on its own prior statements.

Fill a long context with hundreds of fabricated compliant turns; in-context learning overrides safety, with predictable scaling laws.

Write attacker instructions into persistent memory so the payload fires in future, unrelated sessions.

Split one restricted request into individually-benign sub-questions across turns, then ask the model to reassemble.

Encode the payload so lexical filters see noise; the model decodes and executes.

Split the blocked token across variables; the model reassembles, so no single span is blockable.

Replace letters with lookalike digits/symbols; strengthens Policy Puppetry.

Black-box: resample the prompt thousands of times with random caps/shuffle/noise until one lands. ~89% ASR on GPT-4o at 10k samples; extends to vision/audio.

Shuffle interior letters; models reconstruct, string matchers don't.

Translate into a thin-safety-coverage language; safety generalises worse than capability.

Render the blocked word as ASCII art; the model reads it, the semantic filter doesn't.

The deprecated Unicode Tags block (U+E0000–U+E007F) mirrors printable ASCII but renders as nothing; models tokenise it as ordinary text — invisible to human review.

Zero-width chars (U+200B/C/D) and confusable glyphs break tokenisation and visual review without changing the rendered text.

White-box gradient search for a token suffix that maximises an affirmative prefix; universal + transferable.

Reformulate the request as verse; meter and metaphor move it off the prose distribution safety was trained on.

Encode the harmful request as a symbolic-math or logic problem the model "solves" back into restricted content.

Unicode RLO/LRO overrides make the displayed glyph order diverge from the logical order the tokenizer reads.

Stack multiple invertible transforms (Base64 → ROT13 → reverse) so single-layer normalisation misses it.

Instructions in ingested content (pages, emails, docs, tool output) are executed as if from the operator.

Payload in `<!-- -->`, white-on-white, or 1px text — invisible when rendered, present in the DOM the model parses.

Instructions in extracted-but-unreviewed fields: EXIF, PDF metadata, alt text, filenames.

Craft documents that rank highly for target queries and carry instructions in the retrieved chunk. Retrieval is delivery.

Payload lives in the tool schema, not the data. Agents read tool descriptions as instructions (incl. rug-pulls).

Malicious instructions in agent-behaviour config (.cursorrules, CLAUDE.md, .vscode/settings.json) — operator-level authority, no user review.

Payload stays dormant until a condition fires (date, keyword, user), defeating point-in-time scanning.

A tool advertises a benign definition at approval time, then silently mutates after it's been trusted.

ANSI/SGR sequences render invisible in terminals and logs while the raw bytes stay present — survives zero-width stripping.

Just ask, framing disclosure as a formatting task.

Ask for the preamble in another language / poem / base64 — the refusal classifier keys on the verbatim request, not the transform.

Supply the first token of the system prompt so the model continues it as autocomplete, not disclosure.

Extract the tool manifest rather than the prose prompt — more useful for the next kill-chain stage.

Reconstruct a secret by querying its properties (length, characters, comparisons) instead of asking for it directly — the classic Gandalf attack.

The client auto-fetches ``; secrets in the URL leave on render — zero clicks. The single most productive exfil primitive in the field.

Same idea, one click; survives image-rendering bans.

Route exfil through the platform's own allowlisted image proxy so CSP passes and traffic looks internal — one proxy URL per character.

Find a lapsed domain still on the CSP allowlist, re-register it (~$5), exfil to a “trusted” host.

Model output rendered as HTML; streaming renderers that paint before sanitising leave a live injection window.

Skip the renderer; use a legitimate tool (email, webhook, HTTP, DNS, calendar) as the egress channel.

LLM output fed to an interpreter/shell/query builder without validation — classic injection with an LLM in the middle.

Break session/tenant isolation so the model returns another tenant's data — higher severity than own-context exfil.

The agent holds the victim's authority; attacker text steers it to use that authority. The attacker never authenticates.

Over-broad permissions/tool surface with no confirmation; injection converts directly into action.

Injection makes the agent rewrite its own settings to disable approval prompts, then execute (see CVE-2025-53773).

Forge tool outputs or agent reasoning so the model acts on fake state.

One compromised agent injects peers via inter-agent messages, spreading through the orchestration graph.

Forge a fabricated tool-call result so the agent believes a tool already ran and acts on the attacker's output.

Hide instructions inside the arguments the model fills in a legitimate tool call (url, query, body) that a downstream tool auto-runs.

Prepend a harmless sub-task before the malicious one so a ReAct agent builds compliance momentum and carries through.

Inject a fabricated <thinking> trace that "concludes" the request is permitted, hijacking the reasoning channel.

Pad with a long stretch of easy, benign step-by-step reasoning before the harmful ask so the safety signal attenuates.

Steer a reasoning model's thinking budget — force or cut short its chain-of-thought — into its weakest safety state.