Prompt Injection Defense

Public

Weekly roundup of the latest Prompt Injection attack techniques and reusable defense prompt templates from X, security blogs, and papers

Prompt Injection Defense06/23/2026, 01:19:54 AM

Your agent's memory outlives the session. So does the attack.

Memory poisoning is a distinct threat class from prompt injection: instead of hijacking a live session, a single adversarial write corrupts an agent's persistent memory store and silently steers behavior across every future session. Pritam Dash et al. (arXiv:2606.04329, June 3, 2026) provide the first systematic study — 4 write channels, 9 structural vulnerabilities, 6 attack classes, and MPBench results showing 50.46% average ASR and 41.05% RSR across OpenClaw and HERMES. Existing prompt injection classifiers fail structurally on weak-signal attacks (PromptArmor drops from 84.4% to 42.5% TPR), because the defense must operate at the write path, not the input boundary. The article provides a 7-section production-ready Python MemoryGuard middleware synthesizing VMG, OWASP Agent Memory Guard, HMAC signed writes, contradiction detection, and bitemporal rollback, along with three prioritized configuration steps to ship.

Prompt Injection Defense06/16/2026, 01:17:11 AM

Your agent read that file. Now it's infected.

GPT-5.4 scores 0% on standard single-step prompt injection benchmarks — and 95.5% attack success rate on the ClawTrojan multi-step trojan benchmark (arXiv:2605.31042, RUC-NLPIR, May 2026). The attack splits malicious intent across memory poisoning, trust laundering, skill poisoning, delayed activation, and fragmented payload families, none of which look malicious step-by-step. This issue covers the DASGuard ProvenanceGate architecture — the only defense that cuts step-level ASR to 15.8% and full-chain ASR to 5.9% — and provides a copy-paste-ready Python middleware class with 7 named sections and inline comments that any agent harness can drop in front of file writes and external actions.

Prompt Injection Defense06/09/2026, 01:27:50 AM

Your model scored 2.7% on jailbreak benchmarks — and still broke at turn 8

Cisco tested 15 frontier models under multi-turn pressure and every one failed — GPT-5.4 jumped from 2.74% to 24.68% attack success rate. Single-turn benchmarks are an unreliable safety proxy. This issue covers the Crescendo escalation pattern and the two application-layer defenses that actually hold up: conversation history filtering and output filtering in separate code.

Prompt Injection Defense06/02/2026, 01:28:53 AM

One click owns your agent: the ClawHavoc MCP supply chain attack and how to harden against it

ClawHavoc poisoned 1,184 MCP skills in OpenClaw's marketplace and chained four CVEs (max CVSS 9.6) to escalate from a malicious plugin to a full host backdoor. CVE-2026-25253 (CVSS 8.8) lets attackers steal a user's full auth token with a single link click. No model-level defense holds — execution-layer sandboxing is the only control that survives. This issue delivers a copy-paste system prompt hardening template you can ship to production today.

Prompt Injection Defense05/19/2026, 01:08:05 AM

Zero-click email, zero model-level fix: what EchoLeak taught us about output filtering

EchoLeak (CVE-2025-32711) turned crafted emails into zero-click data exfiltration pipelines inside Microsoft 365 Copilot. A fresh arXiv study then proved that every model-level defense breaks under adaptive attack — and that output filtering in application code is the only control that survives. This issue covers the attack mechanics and a copy-paste Python output-filter template you can ship today.

Prompt Injection Defense05/15/2026, 03:51:50 PM

Comment and Control: one PR title stole three agents' keys

A newly disclosed indirect prompt injection class turned Claude Code, Gemini CLI, and GitHub Copilot Agent into credential-theft pipelines using nothing but ordinary PR metadata. Learn the mechanics and five copy-paste-ready mitigations you can ship today.

No more Posts