“Ignore your previous instructions.” Four words, no hacking tools — and against an unprotected AI feature, sometimes that is all an attack takes. Here is how the main LLM attacks work.
Why this matters to your business
AI attacks use plain language, not exploit code — so anyone can attempt them. Knowing the main attack types is the first step to designing features that hold up.
What is prompt injection?
Prompt injection (LLM01) is giving the AI instructions that override yours. Direct injection is typed into the chat: “ignore your rules and…”. Indirect injection is hidden inside a web page, email or document the AI reads — it is the more dangerous kind, because the user never sees it.
What is a jailbreak?
A jailbreak is a prompt designed to get around the model’s safety rules — through role-play, fake “developer mode” requests, or splitting a forbidden request into harmless-looking parts. Guardrails help, but they must be tested against current techniques, not assumed.
How does data leak from an AI feature?
Through sensitive information disclosure (LLM02) and system prompt leakage (LLM07): the AI repeats data from its context, other users’ documents in a shared knowledge base, or its own hidden instructions, keys and internal URLs. Weak access rules in the document search layer (LLM08) are a common cause.
What happens when an AI can take actions?
Excessive agency (LLM06) is when an AI agent has more tools or permissions than it needs. Combined with prompt injection, a single malicious email can make an assistant send data out or change records. Improper output handling (LLM05) is the related risk of trusting AI output as safe code, links or commands.
What are the other risks on the list?
Supply chain (LLM03) and data or model poisoning (LLM04) cover tampered models, plugins and training data. Misinformation (LLM09) is confident but wrong answers that users act on. Unbounded consumption (LLM10) is runaway cost and usage.
What actually stops these attacks?
Give the AI the least access and fewest tools possible, keep secrets out of prompts, enforce permissions in your own code rather than asking the model to, treat all AI output as untrusted, require human approval for risky actions, and test the whole system with real attack prompts before and after every major change.
Key takeaways
- Indirect prompt injection is the most dangerous kind.
- Agents with too many tools multiply the risk.
- Enforce permissions in code, not in the prompt.
Jargon buster
- Prompt injection
- Instructions slipped into the AI’s input to override yours.
- Jailbreak
- A prompt crafted to get around the model’s safety rules.
- RAG
- Retrieval-augmented generation — the AI looks up your documents before answering.
What you should do
- Keep secrets out of system prompts
- Give the AI the fewest tools possible
- Treat AI output as untrusted
- Require approval for risky actions
What our team does
- Run direct and indirect injection tests
- Attempt jailbreaks and data extraction
- Test agent tool use and output handling
- Map every finding to the OWASP LLM Top 10
- Use custom attack prompts, not only automated tools
- Test the full chain: prompt, retrieval, tools and output
Building with LLMs? We test your AI features against these attacks before launch.
— The CRIS InfoTech security team