CrowdStrike's AI security research team has announced the addition of 18 new prompt injection techniques to its industry-leading taxonomy, bringing the total to over 200 distinct methods. Prompt injection remains a significant challenge in the AI era, particularly as AI agents gain more capabilities to interact with external data and systems.
These new techniques demonstrate how adversaries are increasingly manipulating AI systems through subtle and complex means. One such method, Trigger-Activated Rule Addition (PT0201), involves embedding a dormant instruction that activates only when a specific trigger phrase or condition is met, potentially leading to unexpected behavior or policy bypasses.
Another identified technique is Cognitive Token Suppression (PT0197), where attackers aim to hinder an AI's ability to generate secure responses by blocking common refusal terms. While not guaranteeing compliance, this can lead to less guarded or riskier outputs from the AI model.
Algorithmic Payload Decomposition (PT0200) involves breaking down a malicious instruction into smaller, seemingly benign components that the AI then reassembles. This fragmentation helps evade detection systems that might flag the complete malicious instruction.
Special Token Injection (PT0198) targets the structural cues AI systems use to differentiate between commands, user input, and tool outputs. By mimicking these special tokens, attackers can confuse the AI and elevate untrusted content to a higher priority.
Lastly, Unwitting User Delivery (IM0005) leverages social engineering or deceptive tactics to trick authorized users into inadvertently executing malicious prompts. This can happen through copy-pasting or compromised browser extensions, making the user an unwitting vector for the attack.
CrowdStrike highlights four key implications for security teams. AI threat modeling must encompass all potential sources of model context, including prompts, files, and various data pipelines. AI red teaming needs to evolve beyond simple jailbreaks to include testing for boundary mimicry and indirect injection.
Detection engineering should prepare for composite attacks that combine multiple injection methods. Furthermore, AI security programs require runtime visibility to monitor AI interactions, detect threats, and enforce policies effectively.
To address these challenges, CrowdStrike offers its Falcon AI Detection and Response (AIDR) solution, which provides unified visibility, real-time threat detection, data protection, and automated response capabilities for AI systems.
The expanded Prompt Injection Taxonomy aims to provide security professionals, developers, and AI engineers with a clearer understanding of current and emerging prompt injection attack vectors.
