Prompt injection taxonomy shows the gap between intent and technique

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Lasso Security's blog post: Classifying text-based prompt injection attacks requires distinguishing attacker intent from execution technique.

Why it matters: IAM and AI security teams need a shared vocabulary for prompt injection because governance, testing, and monitoring fail when objectives and delivery methods are treated as the same thing.

Context

Prompt injection is a control problem at the language interface, not just a model safety problem. As LLMs move into applications and agentic workflows, attackers can manipulate instructions, context, formatting, encoding, and conversation state to shape behaviour that the system should otherwise refuse. The governance gap is that many programmes still describe the issue as a generic jailbreak risk instead of a set of distinct attack techniques.

The practical value of a taxonomy is that it separates what the attacker wants from how the attack is delivered. System prompt leakage and jailbreak are objectives; instruction override, role-playing, context exploitation, cross-lingual manipulation, payload splitting, and instruction smuggling are techniques. That distinction gives security teams a clearer way to test controls, label incidents, and decide which parts of an AI workflow need stronger inspection or policy enforcement.

Key questions

Q: What breaks when prompt injection is treated as one generic risk?

A: Teams lose the ability to distinguish attacker objectives from delivery methods, so testing, triage, and remediation all become fuzzy. A taxonomy matters because system prompt leakage, jailbreaks, formatting abuse, and instruction smuggling require different controls and produce different failures. Without that separation, security teams measure noise instead of attack paths.

Q: Why does prompt injection create risk in connected AI workflows?

A: Because connected workflows bring external data into the model’s decision surface. If retrieved documents, API responses, or knowledge base entries contain malicious instructions, the model may treat them as valid guidance. That makes the risk operational, not just conversational, especially when the system can access data or trigger actions.

Q: What are the signs that prompt filtering is failing?

A: Common signals include hidden Unicode characters, suspicious formatting, unexpected role shifts, cross-language instruction fragments, and payloads that only become harmful when split across turns. If the system behaves safely on isolated inputs but not on assembled context, the weakness is usually in prompt normalisation or context handling.

Q: How should teams govern prompt content that arrives through HTML or retrieved documents?

A: Treat retrieved HTML and documents as data first, not instructions. The control goal is to stop embedded directives, comments, or hidden elements from being interpreted as task logic. If the workflow cannot preserve that boundary, prompt injection can ride inside otherwise legitimate content and bypass simple content filters.

Technical breakdown

Why intent and technique are different control dimensions

Intent is the attacker’s objective, such as exposing hidden instructions or bypassing a refusal boundary. Technique is the delivery method used to increase the chance of success, such as misleading context, markup abuse, or translation-mediated payloads. These two dimensions are analytically separate because one intent can be executed through many techniques, and one technique can serve benign or malicious goals. In practice, that means detection and governance should not stop at content classification. They need to account for how instructions are shaped, wrapped, split, or smuggled into the prompt stream.

Practical implication: classify prompt-injection events by both goal and delivery method so response teams can map the right control failure.

How instruction override and role-playing bypass model boundaries

Instruction override attacks try to replace the model’s governing instructions with attacker-supplied ones. Role-playing attacks work differently: they create fictional scenes, personas, or operational modes that make unsafe output feel acceptable inside a pretend context. Both patterns exploit the model’s tendency to treat some text as authoritative framing rather than ordinary user content. The security issue is not only malicious wording. It is the model’s susceptibility to having authority, scope, and context reframed inside the prompt itself.

Practical implication: review whether your AI controls validate authority claims and narrative framing, not just prohibited keywords.

Why formatting, encoding, and payload splitting are hard to detect

Formatting manipulation uses layout, whitespace, symbols, and Unicode tricks to hide or de-emphasise malicious instructions. Encoding-based obfuscation conceals the payload until it is decoded, while payload splitting distributes the attack across multiple fragments or turns so that each piece looks harmless alone. These are important because many defensive controls inspect prompts as isolated strings or single messages. Once an attack can rely on cross-turn assembly, hidden characters, or reversible encoding, simple filter-based controls become much easier to evade.

Practical implication: inspect prompt assembly, normalisation, and multi-turn context handling instead of relying on per-message screening.

Breaches seen in the wild

• EchoLeak (Microsoft 365 Copilot) 2025: A crafted email could make Microsoft 365 Copilot leak data from its context with no click, a zero-click prompt injection fixed as CVE-2025-32711.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt injection is now a governance taxonomy problem, not just a red-team tactic. The article shows that the same malicious objective can be delivered through many text-based techniques, which makes one-dimensional policy language too blunt for operational use. Security teams need a classification model that captures both attacker intent and execution method so incidents can be compared consistently and controls can be assigned to the right failure mode.

Language interface abuse creates a control surface that traditional application logic does not cover. Once prompts become part of business workflows, the attack is no longer limited to what the user asks the model to do. It also includes how instructions are wrapped, contextualised, encoded, and reintroduced across turns. That means AI governance has to treat prompt handling as a security boundary, not a UX detail.

Instruction smuggling is a named concept that deserves separate handling. When retrieved content, HTML, or other text to be processed can carry hidden directives, the system is no longer only interpreting data. It is also exposed to disguised instructions embedded inside that data. Practitioners should treat data-to-instruction boundary failures as a distinct class of risk rather than folding them into generic prompt filtering.

Agentic workflows raise the stakes because prompt manipulation can influence downstream actions, not just model output. As LLMs sit inside orchestration layers and tool-using systems, a successful injection can affect what gets retrieved, forwarded, or executed next. That makes prompt taxonomy useful for more than labelling attacks. It becomes a prerequisite for deciding where authorization, logging, and human review have to sit in the workflow.

The decisive control question is whether the system can distinguish technique from authority. If it cannot tell a real instruction from a manipulated one, it cannot reliably govern intent-based access to model capability. The practical implication is that prompt security must be designed as part of identity and workflow governance, not left as a model-only safeguard.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: Agentic AI Identity Guide

What this signals

Instruction smuggling is the concept teams should watch most closely. The article makes clear that the boundary between data and instruction is now part of the attack surface, especially when systems ingest HTML, retrieved text, or conversation history. That means prompt governance has to expand beyond model prompts and into content ingestion paths.

Security programmes that already separate identity, authorization, and workflow policy will have an easier time adapting to prompt injection than programmes that treat the model as a standalone tool. The practical challenge is not just blocking unsafe output. It is deciding where manipulated text is allowed to change behaviour, tool use, or downstream execution.

For practitioners

• Define prompt-injection classes explicitly Create an internal taxonomy that separates objectives such as prompt leakage and jailbreak from delivery techniques such as formatting, encoding, and instruction smuggling. Use that taxonomy in triage, testing, and reporting so incident labels are consistent across teams.
• Inspect prompt assembly and normalisation Review how your application strips, preserves, or transforms whitespace, Unicode variants, markup, and hidden text before the model sees it. Add controls for multi-turn accumulation and payload reassembly, not just single-message filters.
• Separate user data from executable instructions Treat retrieved documents, HTML, and conversation history as untrusted content unless the workflow explicitly validates them. The goal is to prevent hidden instructions from being interpreted as part of the task itself.
• Map AI workflow boundaries to authorization points Place review and policy enforcement where the system decides whether to act, forward, or call tools. A prompt that changes model behaviour should not automatically change downstream privilege or execution scope.

Key takeaways

• Prompt injection should be classified by both attacker intent and delivery technique, because the same objective can use many different text-based methods.
• The article’s taxonomy shows why prompt filtering alone is insufficient when context manipulation, formatting tricks, encoding, and instruction smuggling can all reshape model behaviour.
• IAM and AI security teams need to govern prompt handling as a workflow boundary, not just as a model safety feature.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• System Prompt: The system prompt is the core instruction set that defines an LLM’s behaviour, boundaries, and response style during a session. When attackers influence or override it, they are not merely changing text. They are trying to change the model’s governing authority.
• Instruction Smuggling: Instruction smuggling is the practice of hiding malicious directives inside content the model is asked to process as data. The dangerous part is the boundary violation, where comments, metadata, markup, or embedded text are treated as instructions rather than untrusted input.
• Context Manipulation: Context manipulation is a tactic in which an attacker alters the conversational or tool-use context so the model treats malicious instructions as legitimate. It includes patterns such as conversation spoofing and tool call spoofing. Defenders use this category to group similar attacks and design broader mitigations.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.