Prompt Injection Attacks in Large Language Models and AI Agent Systems: A Comprehensive Review of Vulnerabilities, Attack Vectors, and Defense Mechanisms
Open accessAbstract
Large language models (LLMs) have rapidly transformed artificial intelligence applications across industries, yet their integration into production systems has unveiled critical security vulnerabilities, chief among them prompt injection attacks. This comprehensive review synthesizes research from 2023 to 2025, analyzing 45 key sources, industry security reports, and documented real-world exploits. We examine the taxonomy of prompt injection techniques, including direct jailbreaking and indirect injection through external content. The rise of AI agent systems and the Model Context Protocol (MCP) has dramatically expanded attack surfaces, introducing vulnerabilities such as tool poisoning and credential theft. We document critical incidents including GitHub Copilot’s CVE-2025-53773 remote code execution vulnerability (CVSS 9.6) and ChatGPT’s Windows license key exposure. Research demonstrates that just five carefully crafted documents can manipulate AI responses 90% of the time through Retrieval-Augmented Generation (RAG) poisoning. We propose PALADIN, a defense-in-depth framework implementing five protective layers. This review provides actionable mitigation strategies based on OWASP Top 10 for LLM Applications 2025, identifies fundamental limitations including the stochastic nature problem and alignment paradox, and proposes research directions for architecturally secure AI systems. Our analysis reveals that prompt injection represents a fundamental architectural vulnerability requiring defense-in-depth approaches rather than singular solutions.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
LLMs process both system instructions and user inputs through a unified natural language mechanism, lacking clear syntactic boundaries to separate trusted instructions from untrusted data.
“This vulnerability stems from a fundamental architectural flaw: LLMs process both system instructions and user inputs through a unified natural language mechanism, lacking clear syntactic boundaries to separate trusted instructions from untrusted data [2].”
From Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction (2026) · cites this paper as [2]
Relying solely on built-in model safety is insufficient; defense-in-depth strategies involving external validation layers are necessary to limit damage during inevitable breaches.
“Consequently, the consensus in the cybersecurity community emphasizes that relying solely on built-in model safety is insufficient; instead, defense-in-depth strategies involving external validation layers are strictly necessary to limit damage during inevitable breaches [2].”
From Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction (2026) · cites this paper as [2]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
No references could be resolved yet.
Research works printed but not linked: 8
- Shi, J., Yuan, Z., Liu, Y., Huang, Y., Zhou, P., Sun, L., & Gong, N. Z. (2024). Optimization-based prompt injection attack to LLM-as-a-judge. arXiv. https://arxiv.org/abs/2403.17710 · arXiv
- GitHub Copilot Prompt Injection Flaw Leaked Sensitive Data from Private Repos. https://www.csoonline.com/article/4069887/github-copilot-prompt-injection-flaw-leaked-sensitive-data- from-private-repos.html Preprints.org (www.preprints.org) | NOT PEER-REVIEWED | Posted: Posted: 3 November 2025 doi:10.20944/preprints202511.0088.v1 © 2025 by the author(s). Distributed under a Creative Commons CC BY license. · DOI
- Clop, C., & Teglia, Y. (2024). Backdoored retrievers for prompt injection attacks on retrieval augmented generation of large language models. arXiv. https://arxiv.org/abs/2410.14479 · arXiv
- Attention Tracker: Detecting Prompt Injection via Attention Analysis. https://aclanthology.org/2025.findings-naacl.123.pdf
- Tan, X., Luan, H., Luo, M., Sun, X., Chen, P., & Dai, J. (2024). RevPRAG: Revealing poisoning attacks in retrieval-augmented generation through LLM activation analysis. arXiv. https://arxiv.org/abs/2411.18948 · arXiv
- Zhang, B., Chen, Y., Fang, M., Liu, Z., Nie, L., Li, T., & Liu, Z. (2025). Practical poisoning attacks against retrieval-augmented generation. arXiv. https://arxiv.org/abs/2504.03957 · arXiv
- Gulyamov, S., & Jurayev, S. (2023). Cybersecurity threats and data breaches: Legal implication in cyberspace contracts. Young Scientists, 1(15), 19-22. https://in- academy.uz/index.php/yo/article/view/21738
- Gulyamov, S. S., & Rodionov, A. A. (2024). Cyber hygiene as an effective psychological measure in the prevention of cyber addictions. Psychology and Law, 14(2), 77-91. https://doi.org/10.17759/psylaw.2024140206 Disclaimer/Publisher's Note: The statements, opinions and data contained in all publications are solely those of the individual author(s) and contributor(s) and not of MDPI and/or the editor(s). MDPI and/or the editor(s) disclaim responsibility for any injury to people or property resulting from any ideas, methods, instructions or products referred to in the content. · DOI
Cited by
Sorted by citations
Evaluation of NeMo Guardrails as a Firewall for User–LLM Interaction
Azambuja, A. J., Guilherme, M., Castro, J. V. F. D., Lima, J. P. D. O., Oliveira, L. B., & Soares, A. D. S. (2026) · Future Internet · doi:10.3390/fi18050252 · Cited by 2 · see citing works
A Tripartite Feedback Framework for AI-Assisted Assessment of Complex Reports in Higher Education
Venetsanos, D. T. (2026) · AI in Education · doi:10.3390/aieduc2030026
- Authors
- Gulyamov, S., Gulyamov, S., Rodionov, A., Khursanov, R., Mekhmonov, K., Babaev, D., & Rakhimjonov, A.
- Affiliations
- Department of Information Systems in Economics, Kimyo International University in Tashkent, Tashkent 100121, Uzbekistan
- Department of Cyber Law, Tashkent State University of Law, Tashkent 100047, Uzbekistan
- Tashkent State University of Law (UZ)
- Department of Civil Law, Tashkent State University of Law, Tashkent 100047, Uzbekistan
- National University of Uzbekistan (UZ)
- Venue
- Information
- Publisher
- MDPI AG
- Published
- 2026-01-07
- Volume
- 17
- Issue
- 1
- Pages
- 54
- ISSN
- 2078-2489 (ISSN-L)
- OpenAlex
- W7118532765
- Cited by
- 45
- References
- 0
- Citations by year
- 2026: 45
- FWCI
- 152.78
- Type
- journal article
- Language
- en
- Open access
- gold
- doi.org
- Licence
- Locations
- Information (publishedVersion, cc-by)
- Preprints.org (acceptedVersion, cc-by)
- DOAJ (DOAJ: Directory of Open Access Journals) (submittedVersion, cc-by-sa)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Artificial Intelligence › Security and Verification in Computing
- Keywords
- prompt injection, large language models, jailbreaking, Model Context Protocol, tool poisoning, credential theft, defense-in-depth, remote code execution, GitHub Copilot, ChatGPT
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
