AML.T0051 LLM Prompt Injection: Detecting and Containing Direct, Indirect and Triggered Injection

Prompt injection is the step that turns an LLM or AI agent from a tool you control into one an adversary can steer, and MITRE ATLAS treats it as an execution technique rather than a content problem. ATLAS tracks it as AML.T0051 LLM Prompt Injection, in the Execution tactic (AML.TA0005), with three sub-techniques: Direct (AML.T0051.000), Indirect (AML.T0051.001) and Triggered (AML.T0051.002). This page is the ATLAS view of the technique: how each sub-technique arrives, which telemetry shows it, how to contain it, and which ATLAS mitigations apply. It is a hub. Injection channels, screening and architecture patterns are covered in depth in the Prompt Injection Guide, and the OWASP view in the OWASP LLM Top 10 LLM01 Prompt Injection Guide. It is written for detection engineers, AI platform owners and security architects who already use ATLAS or ATT&CK to organise their coverage.

Key takeaways

• ATLAS rates the parent technique as realised. AML.T0051 and its Direct and Indirect sub-techniques carry the "Realized" maturity in ATLAS 2026.10; Triggered is rated "Demonstrated".
• The three sub-techniques differ by who delivers the prompt and when. Direct comes from the person typing, Indirect from content the system ingests, and Triggered from instructions planted earlier that a later user action or event activates.
• Containment beats detection. The UK NCSC argues prompt injection may never be fully mitigated because an LLM has no reliable boundary between instructions and data, so limit what an injected model can do.
• Telemetry is the first ATLAS mitigation to put in place. AML.M0024 AI Telemetry Logging and Monitoring is mapped to the parent and all three sub-techniques; without prompt, retrieval and tool-call logs you cannot investigate any of them.
• Injection is rarely the goal. In almost every ATLAS case study the injection is followed by AML.T0053 AI Agent Tool Invocation, exfiltration or persistence, so map your detections to the whole chain.

What ATLAS says AML.T0051 is

ATLAS defines LLM prompt injection as an adversary crafting malicious prompts as inputs to an LLM that cause it to act in unintended ways, often by getting the model to ignore parts of its original instructions and follow the adversary's instead. ATLAS notes three properties that matter for defenders: an injection can be an initial access vector that gives the adversary a foothold, it may be designed to bypass the model's defences or issue privileged commands, and its effects can persist across an interactive session.

The technique applies to the "Generative AI" and "Agentic AI" platforms in ATLAS. It was created in October 2023 and last modified in May 2026; the Indirect sub-technique was last modified in September 2026 and cites Google's study of injections found on the public web. MITRE ATT&CK v20 now carries matching enterprise techniques, T1699 Direct Prompt Injection and T1698 Indirect Prompt Injection, both in the Execution tactic. Use the ATT&CK IDs where your SOC content is organised around ATT&CK and the ATLAS IDs for AI-specific threat models; the triggered case exists only in ATLAS.

The three sub-techniques

Two points from the case studies are easy to miss. First, ATLAS files a poisoned agent configuration as Direct: in the Rules File Backdoor and Amazon Q cases the malicious text sat in the agent's own rules or prompt, not in retrieved content. Treat agent instruction files as part of the prompt and protect them like code (see MITRE ATLAS AML.T0081 Modify AI Agent Configuration). Second, the Triggered sub-technique separates delivery from execution in time, which is what defeats incident timelines built around "the user clicked something". EchoLeak needed no click: the email sat in the mailbox until an ordinary Copilot query retrieved it, as described on the EchoLeak 2025 breach page.

Where AML.T0051 sits in an attack chain

ATLAS treats injection as the moment of execution. What comes before and after it decides the impact, and each neighbour has its own technique and NHI Mgmt Group guide.

The Promptware Kill Chain Guide walks the same chain as a single model. For image, audio and document carriers see the Multimodal Prompt Injection Guide; for attempts to bypass safety training rather than application instructions see the LLM Jailbreaks Guide.

How common it is in the wild

Google published a scan of Common Crawl, an archive of public English-language web pages, for indirect prompt injections in April 2026, the reference ATLAS now cites for AML.T0051.001. The authors grouped what they found into harmless pranks, "helpful guidance" that steers AI summaries, SEO manipulation, attempts to deter AI agents, and a small number of malicious exfiltration and destruction attempts. They reported a 32% relative increase in the malicious category between November 2025 and February 2026 and described the activity as showing limited sophistication so far. Two practical consequences follow: an agent that browses the open web will meet injected text routinely, and most of it will be noise, so a detector that alerts on every hit will be ignored.

Detection telemetry by sub-technique

ATLAS maps AML.M0024 AI Telemetry Logging and Monitoring to all three sub-techniques with the note that logging helps identify unsafe prompts submitted to the LLM. In practice the evidence differs by sub-technique, because the malicious text arrives through a different door each time.

The NCSC recommends logging inputs, outputs and tool or API calls, and specifically watching failed calls as a sign an attack is being refined. Keep prompts and retrieved context long enough to rebuild a session: a triggered injection may be planted weeks before it fires. Agent-level baselining is covered in the AI Agent Behaviour Baselining and Anomaly Detection Guide.

Detection metrics

• Trace coverage: share of production LLM applications and agents whose prompts, retrieved context and tool calls reach the SIEM.
• Source attribution: share of retrieved context items logged with source, author and creation time, which is what makes triggered injection traceable.
• Red-team catch rate: share of planted test injections, per sub-technique, that produced an alert or were blocked.
• Time to contain: time from first alert to the agent's tools or connector being disabled in exercises.
• Configuration drift: number of unapproved changes to system prompts, rules files or tool definitions found per month.

Containment: what to do before and after an injection lands

The NCSC's December 2025 post "Prompt injection is not SQL injection (it may be worse)" describes an LLM as an "inherently confusable deputy" and recommends deterministic, non-LLM safeguards that constrain what the system can do, including dropping the system's privileges to the level of the party whose content it is processing. That is the design principle behind the ATLAS mitigations below.

The agent-side mitigations ATLAS maps to AML.T0053, especially AML.M0029 Human In-the-Loop for AI Agent Actions and AML.M0030 Restrict AI Agent Tool Invocation on Untrusted Data, are what limit the blast radius once an injection succeeds. They are covered in the Human-in-the-Loop for AI Agents Guide.

Containment priorities when an injection is suspected

1. Cut the action path first. Disable the affected agent's write and execution tools or its connector, not the whole AI service, so investigation can continue.
2. Find and quarantine the carrier. For Indirect and Triggered cases, locate the email, document, ticket, web page or tool definition in the retrieval log and remove it from every index and cache the agent reads, or the injection will fire again on the next query.
3. Revoke what the agent could use. Rotate tokens and keys the agent held during the session and review OAuth grants used by its connectors.
4. Clear persistent state. Check agent memory, saved instructions and conversation history for planted content (AML.T0080).
5. Scope by identity. Query every tool call made under the agent's identity, or the user's delegated identity, from the first retrieval of the carrier onwards.

The full sequence, including evidence to preserve and notification, is in the Prompt Injection Incident Response Playbook.

Choosing controls by exposure

How much of the above you need depends on two questions: does the system read content that someone outside your trust boundary can write, and can it act?

Smaller organisations using a hosted assistant mostly control the last three columns through configuration: which connectors are enabled, which actions need confirmation, and whether audit logs are exported. Larger organisations building their own agents own the whole stack and should put an AI gateway in front of every model call; see the AI Gateway and LLM Gateway Guide.

Testing for AML.T0051

ATLAS gives AML.M0035 AI Red Team specific guidance per sub-technique: submit controlled instructions directly through user-facing interfaces (Direct), place them in external or retrieved content the system processes (Indirect), and place them in content or workflows where later user actions or events activate them (Triggered), then verify trigger authorisation, context handling, action restrictions and monitoring. Build the test plan as a matrix of input channel by sub-technique, using harmless canary actions (a call to a test endpoint you own, a marker string in output) rather than real payloads. Each test should confirm three things: whether the model followed the instruction, whether a deterministic control stopped the resulting action, and whether an alert fired. Templates are in the AI Red Team Test Plan Template, and automated regression testing in the Promptfoo Guide.

Where identity fits

An injected agent acts with whatever identity it holds. ATLAS notes that indirect injection lets the adversary act against the user "inheriting whatever privileges the AI system holds". In the ATLAS Jira case the injection reached the service desk through the Atlassian MCP server the support engineer's assistant used, acting with that engineer's access. Scoping agent credentials, using delegated rather than shared service identities, and short token lifetimes do not stop injection but decide how much it is worth. See the Agent Identity and Access Guide and the Confused Deputy in AI Agents Guide.

Framework mapping

Common failure patterns

• Relying on a classifier as the boundary. EchoLeak's payload was written to avoid the prompt injection classifier in front of the assistant; guardrails reduce volume but deterministic limits on actions and rendering decide impact.
• Deny-listing phrases. The NCSC warns against blocking known attack strings because attackers rephrase; Google's scan also found most naive pattern matches were false positives such as research pages about prompt injection.
• Logging prompts but not retrieved context. For Indirect and Triggered cases the malicious text is in the retrieved item, not the user's prompt, so a prompt-only log shows an innocent question.
• Short retention. A triggered injection planted in a calendar invite or email can wait until the content is retrieved; if retrieval logs expire first, the carrier cannot be found. The Gemini calendar prompt injection page shows a planted invite activated by a routine schedule question.
• Treating agent rules files as configuration, not code. ATLAS files poisoned rules and agent prompts under Direct; they need review, signing or change control like any other code. See Coding Agent Configuration File Attacks.
• Cleaning the session but not the index. Removing the conversation without removing the carrier from the search index or vector store leaves the injection in place for the next user.

Practitioner checklist

• Record AML.T0051 and its three sub-techniques, and ATT&CK T1698 and T1699, in your AI threat model for every LLM application and agent.
• Log prompt, retrieved context with source and creation time, output, tool calls and identity for every production agent (AML.M0024).
• List every channel through which external parties can place content the model will read.
• Control write access to indexed stores, and treat system prompts, rules files and tool definitions as code under change control.
• Neutralise active output (images, links) and validate tool arguments deterministically (AML.M0033).
• Require approval or block automatic tool calls once untrusted content enters context (AML.M0030, AML.M0029).
• Run red-team tests per sub-technique and input channel with harmless canaries, and track the catch rate (AML.M0035).
• Rehearse containment: disable tools, quarantine the carrier from indexes, rotate the agent's credentials, clear memory.

Standards and references

• MITRE ATLAS: AML.T0051 LLM Prompt Injection
• MITRE ATLAS: AML.M0035 AI Red Team
• MITRE ATT&CK: T1698 Indirect Prompt Injection
• MITRE ATT&CK: T1699 Direct Prompt Injection
• OWASP: LLM01:2025 Prompt Injection
• OWASP: LLM Prompt Injection Prevention Cheat Sheet
• NCSC: Prompt injection is not SQL injection (it may be worse)
• NIST: AI 100-2 E2025 Adversarial Machine Learning, A Taxonomy and Terminology of Attacks and Mitigations
• Google: AI threats in the wild, the current state of prompt injections on the web

Related NHI Mgmt Group resources: Prompt Injection Guide · Prompt injection data theft · MITRE ATLAS Guide · MITRE ATLAS Mitigations Guide