Prompt injection and jailbreaking
Adversarial inputs (prompt injection, jailbreaks, goal hijacking, prompt leaking) bypass instructions or safety controls.
- Risk family
- Security & adversarial
- MIT domain
- 2. Privacy & Security
- MIT subdomain
- 2.2 > AI system security vulnerabilities and attacks
- AI type
- GPAI, Agentic
- Scope
- System
- Source standard
- MIT AI Risk Repository v4
Provenance
39 entries across 11 papers
- Anwar2024Foundational Challenges in Assuring Alignment and Safety of Large Language Models73.07.00 73.07.01 73.07.03 73.07.04 73.08.00
- Cui2024Risk Taxonomy, Mitigation, and Assessment Benchmarks of Large Language Model Systems02.12.00 02.12.01 02.12.02 02.12.03 02.12.04
- G'sell2024Regulating under Uncertainty: Governance Options for Generative AI47.01.02
- Gabriel2024The Ethics of Advanced AI Assistants24.03.07 24.08.01
- Gipiškis2024Risk Sources and Risk Management Measures in Support of Standards for General-Purpose AI Systems62.15.03 62.19.00 62.19.01 62.19.02 62.19.05 62.19.06 62.19.07
- Hagendorff2024Mapping the Ethics of Generative AI: A Comprehensive Scoping Review05.07.00
- IBM2025AI Risk Atlas65.09.01 65.09.04 65.10.01 65.10.02
- Marchal2024Generative AI Misuse: A Taxonomy of Tactics and Insights from Real-World Data64.04.01 64.04.03
- Nah2023Generative AI and ChatGPT: Applications, Challenges, and AI-Human Collaboration33.01.01
- Sun2023Safety Assessment of Chinese Large Language Models27.02.00 27.02.01 27.02.02 27.02.03 27.02.04 27.02.05 27.02.06
- Wang2025A Survey on Responsible LLMs: Inherent Risk, Malicious Use, and Mitigation Strategy74.02.02 74.02.03 74.02.04 74.02.05
Ev IDs of the entries consolidated into this risk in the MIT AI Risk Repository (V4); the source sheet row appears on hover.
Framework crosswalk
Every framework item mapped to this risk. Items marked partial overlap only in part; definitions appear on hover where the source licence permits.
1- A.11 ISO/IEC 23894 Annex A A.11
2- A.6.2.4 ISO/IEC 42001 Annex A A.6.2.4
- A.6.2.6 ISO/IEC 42001 Annex A A.6.2.6
14Expanded into this risk’s technique sub-risks.
9- ibm-context-overload-attack Context overload attack
- ibm-direct-instructions-attack Direct instructions attack
- ibm-encoded-interactions-attack Encoded interactions attack
- ibm-indirect-instructions-attack Indirect instructions attack
- ibm-jailbreaking Jailbreaking
- ibm-prompt-injection-attack Prompt injection attack
- ibm-prompt-priming Prompt priming
- ibm-social-hacking-attack Social hacking attack
- ibm-specialized-tokens-attack Specialized tokens attack
19- AISubtech-1.1.1 Instruction Manipulation (Direct Prompt Injection)
- AISubtech-1.1.2 Obfuscation (Direct Prompt Injection)
- AISubtech-1.1.3 Multi-Agent Prompt Injection
- AISubtech-1.2.1 Instruction Manipulation (Indirect Prompt Injection)
- AISubtech-1.2.2 Obfuscation (Indirect Prompt Injection)
- AISubtech-1.2.3 Multi-Agent (Indirect Prompt Injection)
- AISubtech-1.4.1 Image-Text Injection
- AISubtech-1.4.2 Image Manipulation
- AISubtech-1.4.3 Audio Command Injection
- AISubtech-1.4.4 Video Overlay Manipulation
- AISubtech-19.1.1 Contradictory Inputs Attack partial
- AISubtech-19.1.2 Modality Skewing partial
- AISubtech-19.2.1 Convergence Payload Injection partial
- AISubtech-19.2.2 Chained Payload Execution partial
- AISubtech-2.1.1 Context Manipulation (Jailbreak)
- AISubtech-2.1.2 Obfuscation (Jailbreak)
- AISubtech-2.1.3 Semantic Manipulation (Jailbreak)
- AISubtech-2.1.4 Token Exploitation (Jailbreak)
- AISubtech-2.1.5 Multi-Agent Jailbreak Collaboration
5- NISTAML.015 Indirect Prompt Injection
- NISTAML.018 Prompt Injection
- NISTAML.02 Integrity Violations
- NISTAML.027 Misaligned Outputs
- NISTAML.04 Misuse Violations
2- LLM01:2025 Prompt Injection
- LLM08:2025 Vector and Embedding Weaknesses partial
2- ASI01 Agent Goal Hijack
- ASI06 Memory and Context Poisoning
Sub-risks (10)
Technique-level decompositions of this risk, each anchored to the MITRE ATLAS technique it derives from.
Malicious instructions in user input or retrieved content cause the LLM to ignore its intended task and act on the attacker's instructions.
Crafted inputs make the model ignore, circumvent, or override its safety restrictions.
A prompt-injection payload is crafted to copy itself onward, spreading across messages, documents, or agents.
Prompts cause the model to manipulate citations, links, or UI components users trust, masking malicious content.
Injected instructions are encoded or hidden so they evade input and content filters.
Malicious content is injected into the knowledge base a RAG system retrieves from, steering answers and actions.
Fabricated entries are introduced into the retrieval store so the model surfaces attacker-controlled information.
An attacker alters the conversation history the model relies on to cover tracks or steer behavior.
Malicious prompts are planted in content the system ingests (web pages, documents, tickets) and execute when processed.
Injected instructions lie dormant and execute on a later trigger or future interaction.
More in Security & adversarial
See all Security & adversarial risks →Part of the Deployer AI Risk Register, an open-source resource powered by MindXO. Version 1.0, 3 July 2026. Derived from the MIT AI Risk Repository (V4, December 2025) under CC BY 4.0; an independent derivative work, not endorsed by or affiliated with MIT. Sub-risk decomposition references MITRE ATLAS™ v5.6.0 (© 2021-2026 The MITRE Corporation, reproduced and distributed with permission). ISO/IEC and EU AI Act references are by number only. License: CC BY 4.0. Full attribution and licensing.