Prompt Injection 2.0: Hybrid AI Threats (2507.13169v1)

Abstract: Prompt injection attacks, where malicious input is designed to manipulate AI systems into ignoring their original instructions and following unauthorized commands instead, were first discovered by Preamble, Inc. in May 2022 and responsibly disclosed to OpenAI. Over the last three years, these attacks have continued to pose a critical security threat to LLM-integrated systems. The emergence of agentic AI systems, where LLMs autonomously perform multistep tasks through tools and coordination with other agents, has fundamentally transformed the threat landscape. Modern prompt injection attacks can now combine with traditional cybersecurity exploits to create hybrid threats that systematically evade traditional security controls. This paper presents a comprehensive analysis of Prompt Injection 2.0, examining how prompt injections integrate with Cross-Site Scripting (XSS), Cross-Site Request Forgery (CSRF), and other web security vulnerabilities to bypass traditional security measures. We build upon Preamble's foundational research and mitigation technologies, evaluating them against contemporary threats, including AI worms, multi-agent infections, and hybrid cyber-AI attacks. Our analysis incorporates recent benchmarks that demonstrate how traditional web application firewalls, XSS filters, and CSRF tokens fail against AI-enhanced attacks. We also present architectural solutions that combine prompt isolation, runtime security, and privilege separation with novel threat detection capabilities.

• The paper presents a unified taxonomy of prompt injection threats, classifying attacks by delivery vector, modality, and propagation behavior.
• It details case studies, including XSS, CSRF, and SQL injection, where attackers exploit both AI flaws and traditional web vulnerabilities.
• It evaluates layered defense architectures, like CaMeL and classifier-based input sanitization, achieving up to 77% secure task completion rates.

Prompt Injection 2.0: Hybrid AI Threats — An Expert Overview

The paper "Prompt Injection 2.0: Hybrid AI Threats" (2507.13169) presents a comprehensive and technically rigorous analysis of the evolving landscape of prompt injection attacks, particularly as they intersect with traditional cybersecurity vulnerabilities in the context of agentic and multi-agent AI systems. The authors systematically extend the foundational work on prompt injection, originally documented by Preamble, Inc., to address the emergence of hybrid threats that combine natural language manipulation with exploits such as XSS, CSRF, and SQL injection. This synthesis of AI-specific and classical attack vectors is shown to systematically evade both traditional and AI-native security controls, raising significant operational, ethical, and regulatory concerns.

Evolution of Prompt Injection and Hybrid Threats

The paper traces the trajectory of prompt injection from its initial discovery—where adversarial prompts could override LLM instructions—to its current manifestation as a critical security risk in enterprise and agentic AI deployments. The authors highlight that the proliferation of LLM-powered agents, which autonomously perform multi-step tasks and interact with external tools, has fundamentally altered the threat model. Attacks are no longer confined to isolated prompt manipulation but now exploit the integration of LLMs with web applications, APIs, and multi-agent workflows.

A key contribution is the unified taxonomy of prompt injection threats, which classifies attacks along three orthogonal axes:

• Delivery Vector: Direct (user input), indirect (external data, e.g., web content, documents, APIs).
• Attack Modality: Multimodal (image/audio), code injection, and hybrid (combining prompt injection with web exploits).
• Propagation Behavior: Recursive (self-modifying prompts) and autonomous (AI worms propagating across agents).

This taxonomy provides a structured framework for analyzing both the technical mechanisms and operational implications of contemporary attacks.

Technical Mechanisms and Case Studies

The paper details several hybrid attack scenarios, each illustrating the convergence of prompt injection with established web vulnerabilities:

• XSS-Enhanced Prompt Injection: The DeepSeek XSS case demonstrates how prompt injection can be used to generate JavaScript payloads that bypass CSP and WAF protections, leading to account takeover and data exfiltration. The attack flow is meticulously documented, showing how AI-generated content, treated as trusted by web applications, can deliver executable scripts to end users.
• CSRF Amplified by AI Agents: The ChatGPT plugin exploit exemplifies how AI agents, when manipulated via prompt injection, can autonomously perform privileged operations across plugin boundaries, transforming CSRF from a nuisance into a critical operational risk.
• SQL Injection via Prompts (P2SQL): The authors show that LLMs generating SQL queries from natural language can be induced to perform unauthorized database operations, bypassing traditional input sanitization and ORM-level safeguards.

The analysis extends to multi-agent infection and propagation, where prompt injection attacks can spread recursively or autonomously (AI worms) across interconnected agents, leveraging trusted communication channels to achieve persistent and systemic compromise.

Defense Architectures and Mitigation Strategies

The paper provides a thorough evaluation of both input-level and architectural defense mechanisms:

• Classifier-Based Input Sanitization and Data Tagging: Preamble’s patented methods employ classifiers to detect malicious prompts and token-level tagging to distinguish trusted from untrusted instructions, penalizing models for following user-tagged commands.
• Architectural Isolation (CaMeL): The CaMeL framework enforces strict separation between control logic and untrusted data, using a custom interpreter to track provenance and enforce security policies without modifying the LLM itself. This approach achieves a strong trade-off between security guarantees and task completion rates (77% secure vs. 84% undefended on AgentDojo).
• Spotlighting: This lightweight mitigation marks and isolates untrusted content using structural annotations, guiding the model to semantically distinguish between core instructions and external data, significantly reducing indirect prompt injection success rates without retraining.

The authors advocate for a layered defense-in-depth strategy, integrating these AI-native controls with selective use of traditional security tools for legacy compatibility.

Numerical Results and Claims

The paper reports that all evaluated LLMs remain vulnerable to indirect prompt injection, with more capable models paradoxically exhibiting higher attack success rates in text-based scenarios. Architectural defenses such as CaMeL provide formal security guarantees, solving 77% of benchmark tasks securely, while white-box defense methods can achieve near-zero attack success rates without degrading legitimate performance. These results underscore the inadequacy of traditional web application firewalls and input sanitizers in the face of AI-enhanced hybrid threats.

Implications and Future Directions

The implications of this research are multifaceted:

• Operational Security: Hybrid AI threats necessitate adaptive, AI-native security architectures that blend classical software protections with real-time semantic and behavioral enforcement. The convergence of prompt injection with web exploits creates attack vectors that are invisible to both traditional and AI-specific controls in isolation.
• Regulatory and Ethical Considerations: The rise of AI-driven attacks complicates liability, compliance, and governance, especially as autonomous systems act unpredictably or are manipulated via language-based exploits. The paper highlights the ethical risks of prompt injection in critical processes, such as academic peer review, where hidden prompts can compromise institutional trust.
• Research Directions: The authors identify formal verification of AI security properties, defense of humanoid robots against prompt injection, and human-AI collaboration for security as urgent areas for further investigation. Standardization and interoperability—defining shared threat taxonomies, APIs, and benchmarks—are emphasized as prerequisites for securing the broader AI ecosystem.

Conclusion

"Prompt Injection 2.0: Hybrid AI Threats" provides a technically robust and comprehensive analysis of the evolving threat landscape at the intersection of LLMs and traditional cybersecurity. The paper’s unified taxonomy, detailed case studies, and evaluation of defense architectures offer a valuable foundation for both academic research and practical system design. The findings highlight the necessity of layered, adaptive, and provably secure architectures to address the unique challenges posed by hybrid AI threats, with significant implications for the future of secure, ethical, and accountable AI deployment.