Research · curated 22 Aug 2026
The Anatomy of a Prompt Injection: A Component Model for Structured Analysis
First reported arxiv.org
Coverage timeline
Single-source research — first reported, latest, and curated coincide.
Why it matters
A structured component model for prompt injection gives defenders and CTI teams a stable vocabulary to detect, cluster, and compare attacks that share technique shape even with zero lexical overlap, moving beyond brittle string matching.
A research paper by Jeremy McHugh (Preamble, Inc.) proposes a seven-component model (carrier, delivery vector, concealment, context-break, privilege escalation, payload, return channel) for structurally analyzing prompt-injection artifacts rather than documenting them as verbatim strings. The model is designed to let defenders, red teamers, and CTI teams label, compare, and cluster attacks by attacker intent, with worked examples including EchoLeak (CVE-2025-32711) and an in-the-wild malware sample that embedded a prompt injection to evade AI-assisted analysis.