Direct
Sub-technique of AML.T0051 LLM Prompt Injection
Description
An adversary may inject prompts directly as a user of the LLM. This type of injection may be used by the adversary to gain a foothold in the system or to misuse the LLM itself, as for example to generate harmful content.
- ATLAS ID
- AML.T0051.000
- Maturity
- RealizedUsed by real adversaries against AI systems in the wild.
- Platforms
- Generative AIAgentic AI
Mitigations
- AML.M0024AI Telemetry Logging
Telemetry logging can help identify if unsafe prompts have been submitted to the LLM.
- AML.M0033Input and Output Validation for AI Agent Components
Validation can prevent adversaries from executing prompt injections that could affect agentic workflows.
- AML.M0035AI Red Team
Submit controlled malicious instructions directly through user-facing model and application interfaces. Improve instruction enforcement, input controls, authorization, and monitoring.
Case studies that use it
- AML.CS0016Achieving Code Execution in MathGPT via Prompt Injection
- AML.CS0024Morris II Worm: RAG-Based Attack
- AML.CS0036AIKatz: Attacking LLM Desktop Applications
- AML.CS0041Rules File Backdoor: Supply Chain Attack on AI Coding Assistants
- AML.CS0043Malware Prototype with Embedded Prompt Injection
- AML.CS0047Code to Deploy Destructive AI Agent Discovered in Amazon Q VS Code Extension
- AML.CS0051OpenClaw Command & Control via Prompt Injection
- AML.CS0052LLMSmith: RCE Vulnerabilities in LLM-Integrated Applications
- AML.CS0060Cross-Site Scripting via Prompt Manipulation in Lenovo AI Chatbot
- AML.CS0062RCE Vulnerability in Semantic Kernel Search Plugin
- AML.CS0069GTG-1002 Claude Code Espionage Campaign