LLM Prompt Injection Cheat Sheet

Later instructions compete with — and often beat — the system prompt; there is no hard precedence.

Perez & Ribeiro

Redirect the app's task while the wrapper thinks it's still doing its job.

Perez & Ribeiro

Forge a delimiter or assistant turn so the model believes the trusted region ended and a new authoritative one began.

Simon Willison

Claim a privileged role never granted — "admin" is a token pattern, not an authenticated identity.

Learn Prompting

Forbid refusal markers or force a compliant opening token.

Wei et al.

Inject a forged prior assistant turn into client-supplied history so the model continues from a point where it "already agreed."

Microsoft (Context Compliance Attack)

Inject the model's own structural control tokens (<|im_start|>, tool_call) to forge role boundaries — a real chat-template break, not just text delimiters.

Chat-template injection research

Instantiate an alternate persona defined as unrestricted, then address it.

Shen et al. ("Do Anything Now")

Wrap the request in fiction, simulation, or "for a screenplay" so the output is nominally about something else.

Learn Prompting

Format the request as a policy/config file (XML/JSON/INI) to borrow the elevated trust of structured directives.

HiddenLayer

Single-shot "augment, don't change, your rules — just add a warning label" that unlocks multiple frontier models.

Microsoft (Russinovich)

Make the model act as a scoring-rubric judge, then ask for a highest-severity exemplar.

Palo Alto Unit 42

Embed the unsafe topic among benign ones so attention is distributed and it rides along.

Palo Alto Unit 42

Rephrase a present-tense harmful ask into the past or future — refusal training generalises poorly across tense.

Past-tense jailbreak (EPFL)

A required JSON schema or enum forces harmful content out field-by-field, in a plane prompt-scanners don't inspect.

Chain-enum-attack research

Start benign, escalate by referencing the model's own prior outputs; each step is a small delta from an accepted position.

Microsoft (Russinovich et al.)

Context poisoning — plant lightly-loaded seeds early, then get the model to elaborate on its own prior statements.

NeuralTrust

Fill a long context with hundreds of fabricated compliant turns; in-context learning overrides safety, with predictable scaling laws.

Anthropic

Write attacker instructions into persistent memory so the payload fires in future, unrelated sessions.

Rehberger (SpAIware)

Split one restricted request into individually-benign sub-questions across turns, then ask the model to reassemble.

ActorAttack

Encode the payload so lexical filters see noise; the model decodes and executes.

Learn Prompting

Split the blocked token across variables; the model reassembles, so no single span is blockable.

Kang et al.

Replace letters with lookalike digits/symbols; strengthens Policy Puppetry.

HiddenLayer

Black-box: resample the prompt thousands of times with random caps/shuffle/noise until one lands. ~89% ASR on GPT-4o at 10k samples; extends to vision/audio.

Hughes et al.

Shuffle interior letters; models reconstruct, string matchers don't.

Hughes et al.

Translate into a thin-safety-coverage language; safety generalises worse than capability.

Yong et al.

Render the blocked word as ASCII art; the model reads it, the semantic filter doesn't.

Jiang et al.

The deprecated Unicode Tags block (U+E0000–U+E007F) mirrors printable ASCII but renders as nothing; models tokenise it as ordinary text — invisible to human review.

Goodside / Rehberger

Zero-width chars (U+200B/C/D) and confusable glyphs break tokenisation and visual review without changing the rendered text.

Boucher et al. (Bad Characters)

White-box gradient search for a token suffix that maximises an affirmative prefix; universal + transferable.

Zou et al.

Reformulate the request as verse; meter and metaphor move it off the prose distribution safety was trained on.

Bisconti et al.

Encode the harmful request as a symbolic-math or logic problem the model "solves" back into restricted content.

Bethany et al.

Unicode RLO/LRO overrides make the displayed glyph order diverge from the logical order the tokenizer reads.

Boucher & Anderson (CVE-2021-42574)

Stack multiple invertible transforms (Base64 → ROT13 → reverse) so single-layer normalisation misses it.

String-composition research

Instructions in ingested content (pages, emails, docs, tool output) are executed as if from the operator.

Greshake et al.

Payload in `<!-- -->`, white-on-white, or 1px text — invisible when rendered, present in the DOM the model parses.

Legit Security

Instructions in extracted-but-unreviewed fields: EXIF, PDF metadata, alt text, filenames.

Greshake et al.

Craft documents that rank highly for target queries and carry instructions in the retrieved chunk. Retrieval is delivery.

OWASP LLM08 / research

Payload lives in the tool schema, not the data. Agents read tool descriptions as instructions (incl. rug-pulls).

Invariant Labs / Trail of Bits

Malicious instructions in agent-behaviour config (.cursorrules, CLAUDE.md, .vscode/settings.json) — operator-level authority, no user review.

Pillar Security

Payload stays dormant until a condition fires (date, keyword, user), defeating point-in-time scanning.

MITRE ATLAS

A tool advertises a benign definition at approval time, then silently mutates after it's been trusted.

Invariant Labs

ANSI/SGR sequences render invisible in terminals and logs while the raw bytes stay present — survives zero-width stripping.

Rehberger (Terminal DiLLMa)

Just ask, framing disclosure as a formatting task.

Perez & Ribeiro

Ask for the preamble in another language / poem / base64 — the refusal classifier keys on the verbatim request, not the transform.

Learn Prompting

Supply the first token of the system prompt so the model continues it as autocomplete, not disclosure.

Learn Prompting

Extract the tool manifest rather than the prose prompt — more useful for the next kill-chain stage.

MITRE ATLAS

Reconstruct a secret by querying its properties (length, characters, comparisons) instead of asking for it directly — the classic Gandalf attack.

Lakera (Gandalf)

The client auto-fetches ``; secrets in the URL leave on render — zero clicks. The single most productive exfil primitive in the field.

Rehberger (Embrace The Red)

Same idea, one click; survives image-rendering bans.

Rehberger

Route exfil through the platform's own allowlisted image proxy so CSP passes and traffic looks internal — one proxy URL per character.

Legit Security

Find a lapsed domain still on the CSP allowlist, re-register it (~$5), exfil to a “trusted” host.

Noma Security (ForcedLeak)

Model output rendered as HTML; streaming renderers that paint before sanitising leave a live injection window.

Legit Security (GitLab Duo)

Skip the renderer; use a legitimate tool (email, webhook, HTTP, DNS, calendar) as the egress channel.

MITRE ATLAS

LLM output fed to an interpreter/shell/query builder without validation — classic injection with an LLM in the middle.

OWASP LLM05

Break session/tenant isolation so the model returns another tenant's data — higher severity than own-context exfil.

OWASP LLM08

The agent holds the victim's authority; attacker text steers it to use that authority. The attacker never authenticates.

Simon Willison (lethal trifecta)

Over-broad permissions/tool surface with no confirmation; injection converts directly into action.

OWASP LLM06

Injection makes the agent rewrite its own settings to disable approval prompts, then execute (see CVE-2025-53773).

Rehberger / CVE-2025-53773

Forge tool outputs or agent reasoning so the model acts on fake state.

Agent-security research

One compromised agent injects peers via inter-agent messages, spreading through the orchestration graph.

Lee & Tiwari

Forge a fabricated tool-call result so the agent believes a tool already ran and acts on the attacker's output.

HiddenLayer

Hide instructions inside the arguments the model fills in a legitimate tool call (url, query, body) that a downstream tool auto-runs.

Tool-argument injection research

Prepend a harmless sub-task before the malicious one so a ReAct agent builds compliance momentum and carries through.

FITD-on-agents research

Inject a fabricated <thinking> trace that "concludes" the request is permitted, hijacking the reasoning channel.

CoT-prefill research

Pad with a long stretch of easy, benign step-by-step reasoning before the harmful ask so the safety signal attenuates.

H-CoT research

Steer a reasoning model's thinking budget — force or cut short its chain-of-thought — into its weakest safety state.

Reasoning-budget research