Triggered
Sub-technique of AML.T0051 LLM Prompt Injection
Description
An adversary may trigger a prompt injection via a user action or event that occurs within the victim's environment. Triggered prompt injections often target AI agents, which can be activated by means the adversary identifies during Discovery (See Activation Triggers). These malicious prompts may be hidden or obfuscated from the user and may already exist somewhere in the victim's environment from the adversary performing Prompt Infiltration via Public-Facing Application. This type of injection may be used by the adversary to gain a foothold in the system or to target an unwitting user of the system.
- ATLAS ID
- AML.T0051.002
- Maturity
- DemonstratedShown to work in research or red-team exercises.
- Platforms
- Agentic AI
Mitigations
- AML.M0024AI Telemetry Logging
Telemetry logging can help identify if unsafe prompts have been submitted to the LLM.
- AML.M0033Input and Output Validation for AI Agent Components
Validation can prevent adversaries from executing prompt injections that could affect agentic workflows.
- AML.M0035AI Red Team
Place controlled instructions in content or workflows where later user actions or system events activate them. Verify trigger authorization, context handling, action restrictions, and monitoring.
Case studies that use it
- AML.CS0024Morris II Worm: RAG-Based Attack
- AML.CS0037Data Exfiltration via Agent Tools in Copilot Studio
- AML.CS0059EchoLeak: Zero-Click Prompt Injection Targeting M365 Copilot for Data Exfiltration
- AML.CS0063Prompt-Based Attacks Against Gemini via Calendar Invitations
- AML.CS0064Poisoned GGUF Templates: Inference-Time Supply Chain Attack