lowAgent ThreatPrompt Injection

Structured Component Model for Prompt Injection Analysis (Research Paper)

First seen Aug 11, 2026 · Updated Aug 11, 2026

researchtaxonomyprompt-injectioncti-schemared-teamingEchoLeakliterature-reviewASI01 · Goal HijackingAML.T0051AML.T0054Surface: ModelPropagation: None

This is an academic paper proposing a seven-component taxonomy for classifying prompt-injection attacks (carrier, delivery vector, concealment, context-break, privilege escalation, payload, return channel) to standardize CTI labeling and red-team analysis. It is not itself an exploit or vulnerability disclosure but a defensive/analytical framework referencing known prior attacks like EchoLeak. Severity is low since no new vulnerability, technique, or active threat is introduced.

Technical Analysis

The paper contributes a classification schema rather than a novel attack mechanism, aiming to normalize how prompt-injection artifacts are described so defenders can move beyond fragile verbatim string matching toward intent-based labeling (tool targets, sinks, effects). It synthesizes existing frameworks (HOUYI, Promptware Kill Chain, ReNeLLM) and uses worked examples such as EchoLeak (CVE-2025-32711) and an in-the-wild malware AI-evasion sample to illustrate the model. No new entry point, privilege escalation technique, or cross-agent boundary exploit is disclosed here; the value is purely in structured analysis and CTI interoperability. The practical risk surface remains whatever underlying vulnerabilities (e.g., EchoLeak-style injection via untrusted content into an LLM context) already exist in the systems referenced as examples.

Detection Signatures

  • N/A - this is a classification framework, not an attack; refer to EchoLeak (CVE-2025-32711) advisories for concrete IOCs
  • General guidance: flag natural-language instructions embedded in untrusted content (emails, documents, tool outputs) that attempt context-break or privilege-escalation phrasing
  • Log and review LLM tool-invocation chains where output of one untrusted data source becomes input driving privilege-bearing tool calls

Remediation Steps

  1. 1

    Adopt structured injection taxonomies

    Use component-based models (carrier, delivery vector, concealment, context-break, privilege escalation, payload, return channel) in CTI tooling to improve detection rule generalization beyond string matching.

  2. 2

    Map detections to intent, not wording

    Build classifiers/detectors that identify attacker intent (targeted tool, sink, effect) rather than relying on exact phrase signatures, since LLMs normalize varied phrasing to equivalent actions.

  3. 3

    Review prior disclosed cases

    Study referenced worked examples like EchoLeak (CVE-2025-32711) to understand concrete exploitation patterns this taxonomy is meant to formalize.

  4. 4

    Integrate with existing CTI schemas

    Leverage the paper's mapping to industry CTI schemas to enable sharing and correlation of prompt-injection incident data across organizations.

CVE / Advisory IDs

CVE-2025-32711

Industries Most Exposed

software/AI security researchcyber threat intelligenceany industry deploying LLM agents

Sources

Respond to this threat

Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.