Prompt injection evidence: exposure, influence, and action

The investigative question is where the instruction came from

Prompt injection concerns instructions that attempt to influence an AI system outside the intended control channel. OWASP distinguishes direct injection from indirect injection carried in material the system encounters. A document containing suspicious instructions is therefore an input observation, not a complete causal finding. LLM01:2025 Prompt Injection.

Preserve the instruction in its surrounding material. A quotation, a benign discussion of attacks, and an instruction directed at the system can look similar when removed from context. Examine the retrieval or delivery path and the system’s intended handling of that material.

Separate four parts of the evidence

A page contains a redirection, but the tool is denied

Hypothetical example: retrieved text asks an agent to send information elsewhere. A later tool request targets that destination, but the permission record shows denial. The source text and request may support an influence hypothesis. The denied request does not establish that the transfer occurred.

Check for other attempted paths and available destination or network records within scope. If the relevant logging is incomplete, avoid converting “no transfer observed” into a universal statement that no transfer happened. Keep the supported denial and the logging limit together.

Timing is useful, but it is not the whole explanation

Compare the legitimate task, other inputs, permissions, and recorded behavior. A destination might already have been authorized by the user. A similar instruction might have appeared in another source. An apparent response to injected text might be a coincidence or a quotation.

A controlled replay can test a proposed mechanism when authorized and safely designed. Record changed variables and environmental differences. A successful replay supports behavior in the replay conditions; historical causation still depends on the historical evidence.

Report the highest supported stage

Use precise language such as “the acquired page contains an instruction attempt,” “the run retrieved the page,” “a subsequent request matched the instruction,” or “destination evidence corroborates the requested effect.” These statements can stand separately when the causal chain is incomplete.

Tool protocols such as MCP describe requests and results, not a guarantee that every effect is logged. Correlate the available implementation records rather than treating a tool success string as an independent destination observation. Model Context Protocol: Tools, specification 2025-11-25.

What cannot be inferred from the suspicious text?

Its presence alone does not establish obedience, successful exploitation, data disclosure, or malicious intent by the person who supplied the surrounding document. Keep competing explanations in view and avoid publishing unnecessary attack payloads.

The glossary definition is an editorial reference. OWASP provides security terminology and risk context; it does not validate the cause of a particular case event. This guide addresses defensive interpretation and evidence handling. LLM01:2025 Prompt Injection.

How the sources support this guide

Source comparison: 2026-10-14. Technical concepts, supporting context, and editorial reasoning are distinguished below.

Related concepts and examination guidance

Read the canonical Prompt injection definition, the Interaction Forensics terminology hub, and the related examination reference.

• Human-AI interaction
• Prompt reconstruction

Citation and editorial context

This is an editorial reference. Source checks are separate from independent expert review; no independent reviewer is recorded.

Examples are hypothetical. See the editorial policy, methodology, and correction process.

Shelley, Jesse (ed.). “Prompt injection evidence: exposure, influence, and action.” Synthetic Forensics, 1.1.0-citation-review-1, 2026-10-14. https://syntheticforensics.org/glossary/terms/prompt-injection/ Accessed: add the date you consulted this page.