hackerlogs: Prompt Injection & Jailbreaks https://hackerlogs.com/topics/prompt-injection Direct and indirect prompt injection, jailbreak techniques, and the defences that actually hold up under adversarial pressure. en Thu, 03 Sep 2026 00:00:00 GMT Build an Indirect Prompt Injection Lab in Thirty Minutes https://hackerlogs.com/blog/indirect-injection-lab https://hackerlogs.com/blog/indirect-injection-lab Thu, 03 Sep 2026 00:00:00 GMT Ajain Vivek An indirect prompt injection lab needs three parts: a retriever that fetches attacker-controlled text, a model that treats retrieved text as instructions, and a tool the model can call to prove impact. Build all three locally with a poisoned document, a small model, and a fake exfiltration endpoint, then replay one payload against each defence to see which hold.

Key takeaways

  • Reading about indirect injection convinces nobody; a working demo against your own stack ends the argument in one meeting.
  • The lab needs a side effect, not just a rude answer, because impact is what turns a demo into a funded remediation.
  • Run the identical payload against each defence in turn, so you measure the control rather than your own improvisation.
  • Input filtering blocks your first payload and fails against the second, which is the point the lab exists to make.
  • Removing the model's ability to reach the network changes the outcome where prompt hardening does not.
]]> prompt-injection ai-red-teaming Prompt Injection: Why There Is No Patch, and What Actually Reduces Risk https://hackerlogs.com/blog/prompt-injection-no-patch https://hackerlogs.com/blog/prompt-injection-no-patch Tue, 01 Sep 2026 00:00:00 GMT Ajain Vivek Prompt injection is an attack where untrusted text reaching a language model is interpreted as instructions rather than data. Because models process instructions and content in the same token stream, there is no reliable syntactic boundary between them. Defences reduce blast radius through privilege separation and output handling rather than filtering malicious phrasing.

Key takeaways

  • Prompt injection is an architectural consequence of how transformers consume text, not a bug that a vendor can patch.
  • Indirect injection, where the payload arrives through retrieved documents or tool output, is the variant that matters for real applications.
  • Input filtering fails because the space of adversarial phrasings is unbounded; treat it as telemetry, never as a control.
  • The defences that hold are architectural: least privilege on tools, human confirmation on side effects, and treating model output as untrusted.
  • OWASP ranks prompt injection as LLM01, the top risk in its Top 10 for LLM Applications.
]]> prompt-injection llm-app-security