← Back to learn hub
LLM01

Prompt Injection

11 variants - direct, indirect, RAG pipeline, tool output injection

What is Prompt Injection?

Prompt Injection is ranked LLM01 in the OWASP LLM Top 10 (2025) — the industry-standard taxonomy for large language model security risks. It represents one of the most commonly exploited vulnerability classes in production AI deployments.

How Nemesis tests for it

Prompt Injection

Direct & indirect injection - instruction override, unicode obfuscation, delimiter escape, RAG pipeline, tool output injection.

11 test casesNIST AC-3NIST SI-10NIST SC-28

Real-world incidents

March 2026
McKinsey & Company'Lilli' AI Platform

CodeWall's autonomous offensive agent was pointed at McKinsey's Lilli platform. It found 22 unauthenticated API endpoints through publicly exposed documentation. A JSON field was concatenated directly into SQL queries - a textbook injection flaw. Full read/write access to the production database was achieved in under two hours without any human involvement.

The Register, March 2026
2026 · CVE-2025-32711
MicrosoftCopilot

A researcher shared a PowerPoint presentation with hidden prompt injection payloads embedded in speaker notes. When a recipient asked Copilot to summarise the document, the injected instructions fired and Copilot returned the user's recent private emails instead of a summary.

Microsoft Security Response Center, 2026
2024 · CVE-2024-5184
Vanna AIVanna AI (NL-to-SQL)

Vanna AI's natural language to SQL interface was vulnerable to prompt injection that allowed attackers to craft prompts causing the model to generate and execute arbitrary SQL queries against the connected database - bypassing the intended query restrictions entirely.

NIST NVD, 2024

Test your model for Prompt Injection

Run the full LLM01 attack suite against your LLM in minutes.

Run free scan →