Notifications
Clear all
Topic starter
15/08/2026 8:29 pm
TL;DR: Payload splitting lets attackers distribute a harmful instruction across benign-looking fragments, so keyword and per-message filters miss the threat while the model reconstructs it, according to WitnessAI. The real security gap is session-level intent and runtime governance, because fragmented prompts can still drive data exposure or agent actions.
NHIMG editorial — based on content published by WitnessAI: LLM security analysis of payload splitting and session-level defence
Questions worth separating out
Q: How should security teams defend against payload splitting in AI systems?
A: Use session-level detection, not per-message filtering.
Q: Why do payload splitting attacks bypass traditional prompt filters?
A: Traditional filters look for dangerous strings in a single message, but payload splitting distributes the instruction across fragments that appear harmless on their own.
Q: What do organisations get wrong about AI prompt injection risk?
A: Organisations often treat prompt injection as a text-only problem, when it is really an execution problem.
Practitioner guidance
- Implement session-level intent analysis Evaluate the entire conversation trajectory for cumulative risk, including fragments spread across variables, turns, documents, and tool-calling steps.
- Add bidirectional prompt-and-output inspection Inspect both incoming prompts and outgoing model responses so injected instructions, exfiltration paths, and unsafe generated content are caught at the same control boundary.
- Scope tool and agent privileges tightly Limit each model or agent to the minimum tool set, data source, and action scope needed for the task.
What's in the full article
WitnessAI's full article covers the operational detail this post intentionally leaves for the source:
- Network-level visibility patterns for AI interactions across employees, models, apps, and agents
- Examples of payload splitting variants such as variable assembly, multi-turn drift, and token smuggling
- Runtime defence logic for bidirectional inspection and output filtering before downstream action
- Practical guidance on extending coverage to native apps, embedded copilots, and MCP-connected agents
👉 Read WitnessAI's analysis of payload splitting and session-level AI defence →
Payload splitting in AI systems: are your controls keeping up?
Explore further
15/08/2026 8:30 pm
Payload splitting creates a session-level blind spot, not a prompt-level one. The central failure is assuming that if each fragment looks safe, the conversation is safe. That assumption breaks when the model reconstructs meaning across turns, variables, or documents. Security programmes should therefore treat the session as the unit of analysis, because the attack only becomes visible at that level.
A question worth separating out:
Q: Who is accountable when a model follows a hidden instruction and triggers an action?
A: Accountability sits with the organisation that allowed the model to inherit tool access without adequate runtime governance. If an injected instruction can reach data, APIs, or workflow automation, then identity, privilege, and audit controls were part of the failure. Governance should assign ownership for model behaviour, tool scope, and response escalation.
👉 Read our full editorial: Payload splitting exposes the session-level blind spot in AI security
