Taxonomy of Prompt Injection Attack Vectors

Prompt injection is the top entry on the OWASP Top 10 for LLM Applications 2025, and that ranking undersells the problem. The label covers 47 documented attack techniques, drawn from 78 published studies, spanning at least three distinct dimensions of behavior. Treating "prompt injection" as one threat is like treating "cardiovascular disease" as one diagnosis: technically a category, practically useless for deciding what to do next. The root cause is architectural. Large language models process system instructions, user input, and external data through a single context window with no built-in separation of privilege, the same flaw that made SQL injection possible decades ago, except now it governs autonomous action instead of database queries. Defenses built for one slice of this problem, like keyword filters tuned to catch "ignore previous instructions," fail against the other slices constantly; meta-analysis of the 78 studies found attack success rates exceeding 85% against state-of-the-art defenses once an adversary adapts its strategy even slightly.

The three-dimensional framework that organizes every known attack

A taxonomy proposed in arXiv:2601.17548 organizes the known techniques along three axes, and once you see the grid, the field stops looking chaotic and starts looking like a spreadsheet with some very dangerous cells still empty.

The first axis is delivery vector: how the payload physically reaches the model. That could be direct user input typed straight into a chat box, or it could arrive baked into a document, an email, a web page, a tool's output, a protocol message, or a downloaded skill file. The second axis is attack modality: the mechanism the payload uses to do damage once it's in the context window, whether an override instruction, a persona reassignment, a piece of context manipulation, or a payload shaped by an optimization process rather than a human typing casually. The third axis is propagation: the attack dies after one exchange, lingers across a session, or spreads outward across agents and connected systems.

A second framework, from arXiv:2604.03598, slices the same territory differently, grouping attacks by evasion mechanism into three tiers: syntactic (games played with surface wording), contextual (exploiting how models process sequences of information), and semantic or social (exploiting the model's alignment training itself, the way a con artist exploits trust rather than a lock). A separate, more production-minded taxonomy reduces every real-world incident to three properties: delivery vector, target capability, and detection signal. Different vocabulary, same underlying shape. When three independent efforts converge on a three-part structure, that's not coincidence, that's the actual geometry of the problem.

Direct injection: the oldest vector, still underestimated

Direct injection is the original sin of this field and the one everyone thinks they've already solved. It's not solved, despite direct injection being the original sin of this field and the one everyone thinks they've already handled.

Direct Override is the simplest form: the attacker types an explicit meta-instruction, something like "ignore previous instructions and do X," aimed straight at the system prompt or whatever context came before it. Role Impersonation is the next step up, where the attacker assigns the model a new persona whose rules override the original ones, the digital equivalent of putting on a lanyard and walking past security because you look like you belong.

Keyword filters catch neither reliably, because the failure mode isn't vocabulary, it's grammar. The ClawSafety benchmark (arXiv:2604.01438) found that imperative framing, direct commands, tends to trip existing defenses, while declarative framing, simply stating something as fact rather than commanding it, slipped past every defense tested. Across 2,520 sandboxed trials covering 120 adversarial scenarios, attack success rates ranged from 40% to 75% depending on the model. Read that low end again: the safest model in the benchmark still failed 40% of the time. That's a system that fails more often than a coin flip lands tails, not a rounding error in a security system.

Indirect injection: malicious instructions hidden in trusted content

Indirect injection skips the user. The adversarial instruction lives inside content the agent retrieves and reads on its own, such as an email, a Slack message, a PDF, a web page, a calendar invite, a row in a database, or a config file. Nobody types anything malicious into the chat window, because nobody needs to. The model just encounters the poisoned content as part of its normal job and treats it the way it treats everything else in its context: as trustworthy.

That trust assumption is the entire vulnerability, and it's why a national cybersecurity agency has said this class of attack may never be fully mitigated the way SQL injection eventually was, a characterization cited in one vendor's coverage of the space. SQL injection got solved with parameterized queries because databases can cleanly separate code from data. Language models can't do that yet, not structurally, because everything, instructions and content alike, arrives as the same kind of token stream.

A broader benchmark audit (arXiv:2605.15118) catalogues 47 distinct attack "leaves" across the full taxonomy, 15 of which fall specifically under data-source injection: different content sources each get counted as their own sub-vector, because each behaves differently under attack.

Agentic and tool-based injection: when the attack travels through function calls

This is the largest single category in that 47-leaf taxonomy, with 19 distinct attack leaves, and it's also the most extensively catalogued one in that audit. That's not surprising once you think about what "agentic" actually means in practice: the model is no longer just answering questions, it's calling functions, reading their outputs, and acting on them, often without a human checking each step.

Tool output injection is the headline risk here. A function call returns a result, that result contains an embedded instruction, and the model executes it because it has no reason, structurally, to distrust its own tools. Tool poisoning is a variant one layer up the stack: a malicious MCP (Model Context Protocol) server publishes a tool description that contains hidden instructions, redirecting agent behavior before the tool is ever called. Scans of 1,899 MCP servers found evidence of tool poisoning in roughly 5.5% of them, which, scaled across an ecosystem that's growing by the week, is not a small number.

A related variant involves a server that initially behaves correctly and only later delivers adversarial instructions after the agent has already incorporated it into normal operation. The agent keeps trusting it, because nothing in the interaction ever signaled a reason not to.

Multimodal and supply-chain injection: expanding the attack surface beyond text

The 47-leaf taxonomy includes leaves for multimodal indirect injection: images, audio, and structured data like JSON or code, all serving as carriers for the same kind of hidden instruction that text carries.

Coding assistants pick up injected instructions from comments, docstrings, or files scattered across a repository, because an agentic coding tool reads the whole repo as trusted context, comments included. RAG pipelines have a nastier version of the same problem: poison one document that gets ingested into a knowledge base, and the payload persists across every future query that touches it, no re-injection required. One bad document, indefinite blast radius.

Supply-chain injection turns distribution into the attack itself. One skills-marketplace campaign pushed 1,184 malicious "skills" through its host platform, which is the AI ecosystem rediscovering, at speed, every lesson the software supply chain learned the hard way with compromised open-source package repositories. The lesson doesn't transfer automatically just because the underlying technology changed.

Propagation behaviors: how injection moves across agents, sessions, and systems

Propagation is the dimension that turns an annoying incident into an actual crisis, and it's also the one single-turn input filters are structurally blind to, because those filters only ever look at one turn.

Single-turn contained attacks execute once and leave nothing behind, the lowest-severity outcome on paper, though "low severity" is cold comfort if that one turn was enough to exfiltrate a credential. Session-persistent injection is worse: the 47-leaf taxonomy counts 4 leaves specifically for time-based and stateful attacks, where a payload poisons memory, a RAG store, or conversation history and then sits there, reactivating across sessions without needing to be re-injected. It's a sleeper cell, not a smash-and-grab.

Agent-to-agent propagation is the one that should keep multi-agent system architects up at night. A compromised agent hands its adversarial instructions to a downstream agent it orchestrates or collaborates with, and the injection travels along the same trust relationships the system was built to rely on. The taxonomy in arXiv:2605.15118 folds these into its agentic injection leaves, and the implication is straightforward: the more agents you chain together, the more hallways you've built for one bad instruction to wander down.

Attack Modality, Delivery Vector, and Exploitability

None of these dimensions operates alone, and the ClawSafety results make that concrete. Holding the backbone model constant, attack success rate varies sharply by delivery vector: skill instructions, which carry the highest trust level in an agent's eyes, prove consistently more dangerous than email injection, which in turn beats web content. Trust, not payload cleverness, sets the ceiling on exploitability.

The same benchmark found something almost stranger: identical backbone models showed an 8.6 percentage point swing in attack success rate purely based on which agent framework they were running inside. Safety, in other words, isn't a property of the model, it's a property of the whole stack the model sits in, scaffolding included. And framing itself is a variable independent of everything else: imperative commands tended to trip existing defenses in ClawSafety's tests, while declarative statements bypassed every defense tried, so the surface grammar of an attack, the syntactic layer in arXiv:2604.03598's terms, can decide the outcome regardless of which vector delivered it.

Putting the numbers together reveals a pattern. A production audit found that roughly nine in ten real-world agent incidents arrive through channels the agent already trusts, tool outputs, skill files, the very sources it was designed to rely on, not suspicious user prompts typed by a stranger. The highest-risk combination is an ordinary tool call, running exactly as designed, carrying a payload nobody thought to check. It's an ordinary tool call, running exactly as designed, carrying a payload nobody thought to check.