Passive Prompt Injection via Poisoned Security Logs (LogInject)
First seen Jul 17, 2026 · Updated Jul 17, 2026
This research demonstrates that LLMs used in Security Operations Centers to analyze network/security logs can be manipulated by adversaries who embed prompt injection payloads directly into log-generating fields (e.g., user-agent strings, hostnames, request paths). Because these logs are stored and later fed verbatim into an LLM's context during analyst queries, the injection persists and executes passively, achieving up to 88.2% attack success across production models for goals like hiding malicious activity, generating false positives, exfiltrating data, or hijacking output. This is academic research with a working benchmark and demonstrated mitigations, not an observed in-the-wild exploit, but it describes a realistic and highly exploitable architectural flaw.
Technical Analysis
The entry point is any external-facing service whose logs (HTTP headers, referrers, hostnames, error messages, etc.) are ingested unsanitized into storage and later summarized or triaged by an LLM. Because the LLM cannot reliably distinguish untrusted log content from trusted analyst instructions, an attacker-controlled log field can carry natural-language directives that get executed at query time — a classic confused deputy pattern crossing the boundary between untrusted external data and the trusted LLM reasoning/output layer. The paper's novel 'Context Stitching' technique fragments the injection payload across multiple separate log entries so that stateless, single-entry input filters fail to detect any individual entry as malicious, while the LLM's long-context reasoning reassembles the fragments into a coherent malicious instruction. The attacker's gain ranges from concealing intrusion activity and suppressing true alerts, to forcing false-positive floods (alert fatigue/DoS on the SOC), to exfiltrating sensitive context or hijacking the analysis output shown to human analysts — directly undermining downstream security decisions and human trust in AI-generated triage.
Detection Signatures
- Log fields (user-agent, referrer, hostname, URI path, error/status messages) containing natural-language imperative phrases (e.g., 'ignore previous', 'system:', 'as the administrator', role-play framing, or instruction-like syntax embedded in normally structured/short fields)
- Anomalously long or semantically rich values in fields expected to be short machine-generated tokens
- Multiple related log entries whose concatenated content forms coherent sentences or instructions when read in sequence (Context Stitching indicator)
- LLM outputs that reference or act on directives not present in the analyst's own query
- Discrepancies between raw log severity/classification and LLM-generated summaries (e.g., LLM downgrades or omits alerts present in raw data)
Remediation Steps
- 1
Sanitize and structure log fields before LLM ingestion
Strip or encode natural-language-like content from fields not expected to contain free text; enforce strict schemas/allow-lists for log field formats.
- 2
Deploy layered input filtering
Use pattern-based and semantic classifiers to flag injection-like content in individual log entries, and extend detection to look across related entries to catch fragmented (context-stitched) payloads.
- 3
Prompt hardening and instruction segregation
Clearly delimit and mark untrusted log content separately from trusted system/analyst instructions in the prompt, and instruct the model to treat log content strictly as data, never as directives.
- 4
Output validation against ground truth
Cross-check LLM-generated summaries/alerts against raw log data and rule-based detections to catch suppressed or fabricated findings before they reach analysts.
- 5
Maintain human oversight for security-critical decisions
Do not allow fully autonomous alert suppression, closure, or escalation actions based solely on LLM output; require analyst confirmation for high-impact actions.
- 6
Monitor residual vulnerability
Even with layered defenses, ~8.4% attack success can persist; continuously red-team the pipeline with updated adversarial log samples and track model/version-specific susceptibility.
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.