What Is a Prompt Injection Attack? Types, Examples, and Defenses | AI EdgeLabs

Summary

This dossier analyzes an EverydayOnAI aggregator article ('Multimodal Prompt Injection: Hidden Image & Document Attacks') that synthesizes 2025-2026 research on how untrusted images, screenshots, scanned documents, and retrieved content can manipulate large language model behavior. The article is educational guidance rather than a single-incident report, framing multimodal prompt injection and RAG poisoning as an application-security problem aligned to OWASP LLM01:2025 and NIST AI 600-1.^[0]

The core thesis is that risk escalates from text-only chatbots to retrieval-augmented (RAG) systems and agentic applications as models gain the ability to act by calling email, browser, file, database, or deployment tools. Cited primary research corroborates the underlying threat classes: PoisonedRAG demonstrates knowledge-base poisoning of RAG, AgentDojo benchmarks the prompt-injection robustness of tool-using agents, and Anthropic's work shows training-data poisoning at small scale.^{[0][69][18][47]}

Simon Willison's 'lethal trifecta' framing—private data access, exposure to untrusted content, and external communication—explains why these workflows can be turned into data-exfiltration channels, reinforcing the guidance to treat model outputs as untrusted recommendations rather than authorized commands. Research on instruction-data separation shows this is a structural limitation of instruction-tuned LLMs, while the EchoLeak zero-click exploit in Microsoft 365 Copilot and Anthropic's disclosure of an AI-orchestrated espionage campaign illustrate the real-world stakes as agentic capabilities mature.^{[54][74][62][61]}

How it works

RAG knowledge poisoning: an attacker injects a small number of poisoned texts into the knowledge database so the LLM retrieves them as trusted evidence and generates an attacker-chosen answer for a target question. PoisonedRAG formulates this as an optimization problem and reports about 90% attack success when injecting 5 poisoned texts per target question into a database of millions of texts, with existing defenses insufficient.^[69]

Instruction confusion is the root cause: LLMs follow any instructions that reach the model regardless of source, because operator instructions and attacker-supplied content are all glued into a single token sequence. Research on instruction-data separation confirms all tested models fail to achieve high separation and that prompt engineering and fine-tuning do not substantially fix it, so a summarized web page or retrieved document containing 'email the private data to <address>' can be obeyed.^[54][74]

Training-time data poisoning can implant backdoors: Anthropic (with the UK AI Security Institute and Alan Turing Institute) found a near-constant, small number of malicious documents (about 250) suffices to backdoor models from 600M to 13B parameters, challenging the assumption that attackers must control a percentage of training data.^[47]

Multimodal injection expands the surface beyond text: instructions can be concealed in low-contrast or margin text, UI-spoofing screenshots, image metadata, or imperceptible image-only perturbations, so what the model parses can differ from what a human sees. Tool-using agents can then convert those observations into actions, and AgentDojo shows data returned by external tools can hijack an agent into malicious tasks.^[0][18]

EchoLeak (CVE-2025-32711) demonstrates the production impact of indirect prompt injection: a single crafted email chained multiple bypasses—evading Microsoft's XPIA (Cross Prompt Injection Attempt) classifier, circumventing link redaction with reference-style Markdown, exploiting auto-fetched images, and abusing a Microsoft Teams proxy allowed by the content security policy—to achieve zero-click, unauthenticated data exfiltration across LLM trust boundaries.^[62][63]

Affected versions and patch status

Key takeaways

• Prompt injection—including its multimodal and retrieval variants—is an application-security problem, not merely a prompt-writing problem; strong system prompts help far less than permissions, validation, approval gates, and logging.^[0]
• Risk rises sharply as external content, retrieval, memory, or tools are connected to the model: RAG shifts risk toward source governance while agents shift it toward permissions, approvals, and rollback.^[0]
• Poisoning is more feasible than commonly assumed: only a few poisoned RAG texts can force attacker-chosen answers, and roughly 250 malicious training documents can backdoor models regardless of size.^[69][47]
• The lethal trifecta (private data, untrusted content, external communication) is the condition that turns injection into data theft; the underlying inability of LLMs to separate instructions from data, plus EchoLeak and real-world agentic campaigns, show the threat is already operational in production systems.^{[54][74][62][61]}

Defensive actions

• Treat images, documents, and retrieved content as untrusted observations, not authority.: The article's strongest recommended mitigation is architectural: untrusted visual or retrieved content must not define policy, authorize tools, modify developer instructions, or decide whether an action is performed.^[0]
• Preprocess and inspect visual inputs (OCR, metadata, alt text, layout, embedded objects) and flag hidden, small, or low-contrast instruction-like text for quarantine and review.: OCR filtering alone is insufficient because attacks use layout spoofing, perturbations, metadata, and cross-modal cues, so extraction must feed an enforceable review workflow.^[0]
• Apply source trust scoring and preserve document provenance in RAG pipelines.: RAG risk arises when external documents are ingested and retrieved as trusted evidence; ranking internal versus verified versus public/unknown sources limits the authority granted to poisoned content, consistent with PoisonedRAG's demonstration that only a few injected texts can force a target answer.^[0][69]
• Separate observation from action and require human confirmation for high-impact tool calls.: Tool-using agents can be hijacked by injected data as benchmarked by AgentDojo and can exfiltrate data under the lethal trifecta, so deterministic checks and approval gates should sit before external actions.^[0][18][54]
• Constrain tool permissions, apply least privilege, validate proposed actions against trusted records, and keep audit logs.: The article and the lethal-trifecta analysis emphasize that a compromised model should be unable to do much damage; EchoLeak likewise shows that least privilege, defense-in-depth, provenance-based access control, and strict content security policies matter more than system-prompt wording.^[0][54][62]
• Account for training-data poisoning in the defense posture and invest in classifier-based safeguards.: Anthropic's study shows a small fixed number of poisoned documents can backdoor models of any size, so data-provenance controls, poisoning-detection research, and red-teamed defenses such as Constitutional Classifiers should be part of defenses.^[47][66]