CrowdStrike list of prompt injection attacks has 222 methods

CrowdStrike, a security company, published a new version of its public Prompt Injection Taxonomy, a list of attack methods. Prompt injection is hidden text that makes an AI model do what the attacker wants. The list has 222 methods. The new methods are for autonomous agents and how they plan. CrowdStrike gave no data on how frequently they work.

How it works

An agent breaks a goal into steps and selects tools. An attacker shapes the text that the agent plans from. The new methods are:

• Goal Decomposition Exploitation: the attacker changes the sub-tasks of the agent.
• Constraint-Driven Task Steering: the attacker stops the usual path, and the agent takes the path of the attacker.
• Output Exclusion Prompting: the attacker bans refusal words.
• Session State Spoofing: the attacker puts in a fake summary or memory record.

The proof

CrowdStrike gives a hypothetical scenario. A changed test tool tells a coding agent to send local config files to an external server. Each step looks usual alone.

What is not known

There are no test results or attack rates. CrowdStrike says defenses that examine each step alone can miss the plan.

Insight: Attacks built from usual steps beat checks of single steps

A public challenge test found a 58 percent attack success rate for GPT-4o, and 32 percent for Meta SecAlign, which has training against prompt injection. CrowdStrike lists attacks where each step is usual. This reads as the fight moving from the prompt filter to the plan of the agent, and a filter alone seems not sufficient. Teams that ship agents must examine full step sequences.