Prompt injection is the new SQLi: attacking LLM features in prod

Support bots with tool access are the softest target we test. Prompt injection lets an attacker borrow the model's privileges, and from there data exfiltration is often a single well-crafted message away.

The attack chain

A user submits a message to a customer support bot that has access to the customer dashboard API. The bot reads the message, queries the user's account, and summarizes the findings.

The attacker sends a prompt that looks like a normal support request but contains an instruction to summarise their output and return it in a structured format. The model, tasked with "being helpful," may comply with the user's request to reformat the output so that it can be fed to another LLM or a scraper.

A real scenario from our scans

We tested a client's internal dashboard integration and found a prompt injection that resulted in the model returning the full content of an unauthorised endpoint in a JSON block. No exploit, no custom prompt template — just a model that followed instructions.

What actually mitigates it

1. System prompt isolation — but not enough alone. Use a system prompt that tells the model its role and constraints. This helps but is insufficient on its own, because sophisticated injection techniques can override or re-frame the system prompt in the user message.
2. Tool call sandbox. Restrict what the model can call. Deny list endpoints that return sensitive data, and scope tokens per-role. If the model can only call GET /public/help-articles, the attacker can't exfiltrate through it.
3. Output sanitisation. Parse the model's output into typed data before rendering it. If the model returns a JSON field with a user's email, treat it as opaque text — not as something the next user can execute or forward.
4. User input filtering. Strip or neutralise control sequences from user input (e.g. \n\n, backtick blocks, nested JSON/XML structures). This breaks many injection patterns but not all — combine with other controls.
5. Monitor for repeat offenders. If a single user triggers the same injection across multiple sessions, mark that user for review.

Why it matters

Prompt injection is still under-the-radar in most pentests. It won't show up in a scanner's signature list, but it gives an attacker the same outcome as a traditional access issue: unauthorised data access. The mitigation isn't a config option — it's a security boundary that treats every user message as potentially adversarial.