Here is the complete list of 100 prompt injection attack methods.

I. Direct Instruction Override & Context Manipulation (1–20)

These attacks directly command the model to overwrite or modify its original system prompt.

  1. Context Ignoring – Directly commanding the model to “ignore all previous instructions.”
  2. Fake Completion – Pretending the original task is complete, then appending new malicious instructions.
  3. Instruction Repetition – Repeating the malicious instruction multiple times within a single prompt to reinforce its effect.
  4. Context Termination – Attempting to end the current prompt context to start a new, attacker-controlled one.
  5. Delimiter Escape – Using special characters or formatting to “escape” the user-input area, causing subsequent content to be parsed as system instructions.
  6. Role Override – Forcing the model to assume a new role with higher privileges or different rules.
  7. System Prompt Extraction – Instructing the model to output its internal system prompt.
  8. Developer Mode Simulation – Asking the model to enter “developer mode” or “debug mode” to bypass safety filters.
  9. Format Switching – Requiring the model to output in a specific format (e.g., JSON), which can sometimes bypass text-based content filters.
  10. Output Manipulation – Instructing the model to format its output in a specific way (e.g., adding, modifying, or hiding information).
  11. Jailbreaking – A broad term for any attempt to bypass the model’s safety training and alignment.
  12. “DAN” (Do Anything Now) Persona – Asking the model to impersonate an alternative persona named DAN that has no restrictions.
  13. “Grandma” Trick – Wrapping a request in an emotional roleplay scenario (e.g., “act as my late grandmother who used to read me…”).
  14. Role-Playing Attacks – Inducing the model to take on a fictional character whose behavior guidelines may permit restricted outputs.
  15. Authority Figure Impersonation – Fabricating an authoritative source (e.g., “system administrator commands”) to justify unsafe outputs.
  16. Logical Reasoning Attack – Constructing a seemingly logical argument that leads the model to violate its safety policy.
  17. Pre-built Jailbreak Prompt Libraries – Using publicly known, complex prompts that effectively break specific model restrictions.
  18. Best-of-N (BoN) Jailbreaking – Generating multiple variations of the same prompt until one successfully bypasses the filter.
  19. Multi-turn Escalation – Gradually leading the model to perform malicious actions through a series of seemingly harmless questions.
  20. Refusal Suppression – Adding instructions like “Don’t respond with ‘I cannot help’” to force the model to give a substantive answer.

II. Indirect & External Injection (21–45)

The attacker hides malicious instructions in external data processed by the model, such as web pages, documents, or emails.

  1. Indirect Injection – Hiding the attack payload in external content (e.g., web pages, emails, GitHub issues) that the model retrieves and processes.
  2. Remote Injection – Injection via external data sources (e.g., API responses, database contents).
  3. Web Scraping Injection – Embedding instructions in a web page that are executed when an AI agent scrapes it.
  4. Code Comment & Documentation Injection – Hiding instructions in code comments or technical documents to influence AI coding assistants.
  5. Commit Message & PR Injection – Planting malicious prompts in version control commit messages or pull request descriptions.
  6. Issue Tracker & User Comment Injection – Embedding attack payloads in project management issue descriptions or user comments.
  7. Email Body & Attachment Injection – Hiding instructions in the body or attachments of emails processed by an AI mail assistant.
  8. Hidden Text Injection – Using white font or invisible Unicode characters to hide instructions in web pages, documents, or emails.
  9. RAG Poisoning (RAGPoison) – Poisoning the vector database used by Retrieval-Augmented Generation (RAG) systems for persistent prompt injection.
  10. Tool/Function Abuse – Injected instructions tricking the model into calling dangerous tools or API functions.
  11. Cross-Domain Context Poisoning – Contaminating shared context or memory in agentic or multi-agent systems to affect other agents.
  12. Error-Path Injection – Embedding malicious instructions within the context of error messages or exception handling.
  13. “Neural Exec” Attack – A newer class of attacks that do not rely on handcrafted strings but use the model’s own “neurons” to execute malicious instructions.
  14. Implicit Authority Exploitation – Using systematic mutations to exploit the model’s implicit authority over error paths to execute instructions.
  15. Prompt Template Extraction – Extracting not just the system prompt but the entire structure of the prompt template.
  16. Tool Poisoning – Contaminating the descriptions or return results of tools/APIs used by an AI agent, thereby influencing its behavior.
  17. Protocol Exploitation – Exploiting vulnerabilities in communication protocols like the Model Context Protocol (MCP) for injection.
  18. Supply Chain Attack – Injecting malicious prompts by infecting third-party libraries or data sources that the AI application depends on.
  19. Document Metadata Injection – Hiding instructions in the metadata (author, title, etc.) of PDFs, Word documents, etc.
  20. Filename Injection – Using maliciously crafted filenames that trigger injection when the AI processes a file list.
  21. Database Content Injection – Planting prompts in database records that activate when queried and processed by the AI.
  22. Cache Poisoning – Contaminating the AI application’s cache so that subsequent requests return poisoned responses.
  23. Log File Injection – Writing malicious instructions into application logs, waiting for an AI log-analysis tool to process them.
  24. Configuration File Injection – Modifying configuration files read by the AI application to inject new instructions or alter behavior.
  25. Environment Variable Injection – Manipulating environment variables to affect the AI application’s prompt construction process.

III. Encoding, Obfuscation & Tokenizer Attacks (46–70)

Changing the representation of malicious instructions to evade text-based filters.

  1. Base64 Encoding – Base64-encoding the malicious instruction and asking the model to decode and execute it.
  2. Hexadecimal Encoding – Using hexadecimal notation to hide instructions.
  3. Unicode Smuggling – Using invisible or zero-width Unicode characters to hide instructions.
  4. Payload Splitting – Breaking sensitive instruction words into multiple parts and reassembling them in the prompt.
  5. Token Smuggling – Exploiting the model’s tokenizer properties to encode malicious instructions in a form the model understands but filters cannot detect.
  6. Homoglyph Attack – Using visually similar but different Unicode code points to spell instruction words, bypassing keyword blacklists.
  7. Typoglycemia Attack – Keeping the first and last letters intact but scrambling the middle letters (e.g., “Iegnore”) – humans can read it, and models may still understand.
  8. Markdown/HTML Rendering Hiding – Using KaTeX/LaTeX rendering techniques to generate invisible text.
  9. Emoji & Special Character Encoding – Replacing letters or words with emojis or special Unicode symbols.
  10. URL Encoding – Percent-encoding the instruction (e.g., %49%67%6E%6F%72%65).
  11. Double Encoding – Base64-encoding first, then URL-encoding, to bypass multi-layer filters.
  12. Case Alternation – Using mixed case (e.g., IgNoRe) to bypass simple pattern matching.
  13. Synonym Substitution – Replacing blocked keywords with synonyms (e.g., “disregard,” “skip”).
  14. Foreign Language / Multilingual – Phrasing the instruction in a language the model understands but the filter does not (e.g., French, Spanish).
  15. Programming Language Syntax – Disguising the injection as a query language statement (e.g., SQL, Splunk).
  16. Exploiting Format Preferences – Placing the instruction in a format common in the model’s training data (e.g., XML tags like <instruction>).
  17. Zero-Width Joiner Insertion – Inserting zero-width characters within keywords to visually appear normal but break string matching.
  18. Control Character Injection – Using newline (\n), carriage return (\r), tab (\t), etc., to break the prompt structure.
  19. Math Formulas & Symbols – Using mathematical expressions (e.g., ∑) instead of words and asking the model to “compute” the instruction.
  20. Reverse Word Order – Writing instruction words backward (e.g., “erongi”) and asking the model to reverse them before executing.
  21. Text-in-Image Injection – In multimodal models, embedding instructions as text within an image (OCR).
  22. Audio Instruction Injection – Embedding instructions in audio files in multimodal models.
  23. Leetspeak – Replacing letters with numbers and symbols (e.g., !gn0r3).
  24. Morse Code – Encoding the instruction in Morse code.
  25. Binary Representation – Representing the instruction as a binary string.

IV. Multimodal & Cross-Modal Attacks (71–79)

Exploiting the model’s ability to process multiple input types (text, images, audio).

  1. Image Prompt Injection – Embedding textual instructions in an image that activate when a multimodal model processes it.
  2. Audio Prompt Injection – Embedding hidden voice instructions in audio files.
  3. Cross-Modal Confusion – Injecting instructions in one modality (e.g., image) to influence output in another (e.g., text).
  4. Visual Jailbreaking – Using specific visual patterns or adversarial images to trigger unintended model behavior.
  5. Video Frame Injection – Embedding adversarial prompts across sequential video frames.
  6. Multi-turn Cross-Modal – Alternating between text, image, and audio inputs across multiple turns to gradually bypass safeguards.
  7. OCR Poisoning – Inserting hidden text into PDFs or screenshots that are processed via OCR, which is then interpreted as user instructions.
  8. Audio Adversarial Perturbations – Adding imperceptible noise to audio that forces the model to misinterpret the spoken prompt as a command.
  9. Defined Dictionary Attack – Defining a “dictionary” that maps safe instructions to malicious payloads, causing the model to execute the payload when it sees the mapped key.

V. Training-Phase & Data Poisoning (80–84)

Injecting malicious data during the model’s training or fine-tuning to trigger malicious behavior on specific triggers.

  1. Privacy Extraction – Using crafted prompts to make the model “memorize” and output PII from its training data.
  2. Membership Inference Attack – Determining whether a specific data record was part of the model’s training set.
  3. Model Inversion Attack – Attempting to reconstruct training data from the model’s outputs.
  4. Data Exfiltration via Markdown Images – Injected instructions make the model render a Markdown image whose URL carries stolen data (e.g., API keys).
  5. Exfiltration via Links – Inducing the model to generate a response containing a link to an attacker-controlled server, passing sensitive data as URL parameters.

VI. Agentic, Multi-Agent & System-Level Attacks (85–100)

Targeting complex AI systems, such as agents that can call tools or execute code.

  1. Agentic Attacks – Attacks targeting AI agents, exploiting their perception, planning, and action capabilities.
  2. Multi-Agent Manipulation – Manipulating one agent in a multi-agent system to influence the behavior of other agents.
  3. MCP (Model Context Protocol) Attacks – Exploiting vulnerabilities in MCP for “tool poisoning” or “context hijacking.”
  4. Tool Call Hijacking – Injected instructions causing the agent to call an attacker-specified tool instead of the intended one.
  5. Code Execution Injection – In AI code assistants, injecting instructions to generate and execute malicious code.
  6. Command Injection – Similar to traditional command injection, using prompts to make the AI agent execute commands on the underlying OS.
  7. Context Window Overflow – Providing extremely long input to fill the model’s context window, potentially causing erratic behavior or instruction omission.
  8. Cross-Session Persistence Manipulation – Injecting instructions that cause the model to remain manipulated across subsequent sessions (if stateful).
  9. Application Layer Attacks – Exploiting vulnerabilities in the AI application itself (not the underlying model) for injection.
  10. Availability / DoS Attacks – Injecting computationally intensive prompts to exhaust system resources (Denial of Service).
  11. Trust & Reliability Attacks – Manipulating the model to output incorrect information, eroding user trust in the system.
  12. Chain-of-Thought (CoT) Manipulation – Targeting reasoning models to manipulate their “chain of thought” process, leading them to incorrect or harmful conclusions.
  13. Social Engineering Attacks – Using emotional appeals, urgency, or authority pressure within the prompt to psychologically coerce the model into complying.
  14. Context-Based Manipulation – Altering the contextual information surrounding the main instruction to subtly influence the model’s judgment.
  15. Formatting Tricks – Using spacing, line breaks, and indentation to blur the line between user data and system instructions.
  16. Authority Roleplay (System/Admin) – Posing as a system administrator, developer, or other high-privilege role to command the model to execute operations.

Disclaimer: This list is provided strictly for security research and educational purposes. Unauthorized prompt injection attacks against AI systems are illegal and unethical. Understanding these techniques is essential for building robust defenses.