Topic starter
02/08/2026 12:15 pm
TL;DR: More than 80 new LLM attack scenarios, including prompt injection and jailbreak testing across AWS Bedrock and Azure OpenAI, are described in research on Exposure Validation to measure how models behave under adversarial pressure and where filtering, prompt isolation, and execution controls still fail, according to Cymulate. The analysis shows that LLM security cannot rely on content filters alone, especially as copilots, agents, and autonomous tools expand the attack surface.
Editorial analysis by NHI Mgmt Group, based on content published by Cymulate: “Testing LLM Resilience: How Cymulate Exposure Validation Simulates Prompt Injection and Jailbreaks”.
Key questions
Q: What breaks when LLM prompt injection is not separated from trusted instructions?
A: When trusted policy and untrusted user content share the same instruction stream, attackers can overwrite or steer model behaviour with obfuscated prompts, roleplay, or reverse instructions.
Q: Why do AI copilots and agents make prompt injection risk worse?
A: They widen the impact of a successful injection.
Q: What do organisations get wrong about LLM safety filters?
A: Many organisations assume a filter that blocks obvious harmful wording is enough.
Practitioner guidance
- Define prompt trust boundaries Separate system instructions, user input, and tool directives so the model cannot treat untrusted content as policy.
- Test against obfuscated jailbreaks Run scenarios that use roleplay, reverse instructions, token stuffing, and narrative camouflage to confirm controls still hold.
- Constrain tool execution rights Limit what copilots and agents can invoke, and require explicit approval for actions that change data or state.
Bottom line: Prompt injection remains a practical risk because LLMs still struggle to distinguish trusted policy from adversarial user input when both share the same context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:17 pm
Prompt injection is now a governance issue, not a novelty attack. Once LLMs sit inside copilots, agents, and workflow automation, the attack target is no longer just model output. It is the model's authority to interpret instructions and trigger actions. Security teams should treat prompt hierarchy, tool scope, and output handling as part of the control plane.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should security teams test LLMs for jailbreak risk before production?
A: Test the model with both single-turn and multi-turn adversarial prompts, plus indirect injection from the same content channels your application will ingest. Score success by harmful output category, not just refusal rate, and repeat the tests after every prompt, model, or tool-chain change so you can see whether the attack surface is expanding or shrinking.
👉 Read our full editorial: LLM resilience testing shows why prompt injection still matters