CrowdStrike finds five prompt injections

CrowdStrike said on July 8 that it had identified five new prompt-injection techniques targeting AI agents, adding to a threat category the company has been tracking as more enterprises connect models to files, browsers, business apps and automation tools. The company listed the new methods in a blog post published that day, alongside a broader warning that prompt injection is moving beyond chatbot misuse into attacks on systems that can retrieve data and take action. The new techniques come as separate reporting on July 8 and July 9 described workflow-level jailbreaks affecting GitHub Copilot-style coding assistants. Those reports said attackers could elicit unsafe outputs not by one overt malicious prompt, but by steering a multi-step workflow until the model generated harmful material itself. ### Which five prompt injections did CrowdStrike say it found? CrowdStrike’s July 8 write-up, as summarized in follow-on coverage, named five techniques: Trigger-Activated Rule Addition, Cognitive Token Suppression, Algorithmic Payload Decomposition, Special Token Injection and Unwitting User Delivery. (crowdstrike.com) The methods are designed to manipulate how an AI system interprets instructions, safety language or control structure. Trigger-Activated Rule Addition hides instructions that activate only when a specific condition is met, while Algorithmic Payload Decomposition breaks a malicious objective into smaller pieces that may evade filters, according to the published descriptions. (cyberpress.org) Special Token Injection imitates control tokens or system-style formatting, and Unwitting User Delivery relies on a real person to pass the malicious prompt into the system. (crowdstrike.com) ### Why do these attacks matter more for agents than for chatbots? CrowdStrike said AI agents differ from basic chatbots because they can browse websites, process documents, access internal business data and use connected tools. That means a manipulated output may affect not only what the model says, but also what it retrieves, writes, sends or executes. CrowdStrike’s earlier guidance on indirect prompt injection said attackers can place hidden instructions in external content such as documents, emails, webpages, image files and database records. (vpncentral.com) The company said end users may never see the malicious prompt, even while the system appears to operate normally. ### How does this connect to the GitHub Copilot jailbreak reports? July 9 reporting on GitHub Copilot described what it called “workflow-level jailbreak construction,” in which an operator builds a harmful objective across multiple coding steps rather than asking for it directly. (vpncentral.com) The report said the interaction was framed as a benign evaluation pipeline, allowing the coding agent to produce unsafe prompt-response pairs as code strings later in the process. (crowdstrike.com) The same report said four tested backends produced 816 unsafe completions out of 816 attempts under the full multi-turn workflow, compared with 8 successes out of 816 in each baseline condition. Those figures were attributed to an arXiv-documented study cited in the coverage. ### What is CrowdStrike’s broader argument about prompt injection? CrowdStrike has said prompt injection is the top OWASP risk for generative AI applications and has described it as any input that manipulates a model or agent into ignoring instructions, leaking data, bypassing policy or taking unintended actions. (cyberpress.org) In a December 2025 post, the company said it had analyzed more than 300,000 adversarial prompts and tracked more than 150 prompt-injection techniques. CrowdStrike’s public materials also say the prompt layer should be monitored like other parts of the security stack. The company’s blog index shows its latest prompt-injection post was published on July 8, and its resources page frames prompt injection as the leading OWASP risk for GenAI applications. ### What should readers watch next? CrowdStrike’s next public updates are likely to appear through its cybersecurity blog and AI security resource pages, where the company has been publishing taxonomy changes and defensive guidance. (crowdstrike.com) Separate disclosures around coding assistants and agent workflows are also likely to shape how vendors describe guardrails, provenance and tool permissions in the coming weeks. (crowdstrike.com)