InfoSecBulletin Cybersecurity for mankind
CrowdStrike has shared five new ways to inject prompts, showing the rising danger to AI agents as more organizations use autonomous AI systems. Early risks were mainly about simple chatbot misuse. Now, AI agents can look at websites, access internal data, and carry out commands. This has greatly increased the areas that can be attacked.
Adversaries are adding harmful instructions to the data these agents use. This allows attacks that can take over system actions without clear signs. CrowdStrike has added 18 new techniques to its prompt injection list to tackle this increasing challenge. Now, there are over 200 methods recorded.
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
Anthropic unveils “OSS Scanner” Free AI Vulnerability Scanner for Open-Source Projects
Rise on RCE Exploits Targeting Hikvision Camera Flaw
FortiBleed Attack Compromised 80,000+ Devices, SonicWall Patches 4 SMA1000 Flaws CVSS 10
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Five new methods show how attackers are improving their tactics to avoid being caught and to gently influence AI systems.
5 New Prompt Injection Techniques
One important technique is Trigger-Activated Rule Addition. In this method, attackers hide instructions that stay inactive until a certain condition or keyword makes them active.
These “sleeping” payloads can bypass initial security reviews and later alter system behavior, such as silently exfiltrating sensitive data once triggered.
Cognitive Token Suppression is a new method. It tries to stop an AI from giving safe answers by limiting its use of refusal or policy words.
By changing the model’s usual safety words, attackers make it more likely to give unclear or wrong answers.
Algorithmic Payload Decomposition is a trick used to avoid detection. Instead of sending a harmful command all at once, attackers split it into smaller parts that seem safe.
Trigger-Activated Rule Addition (PT0201): Hidden triggers activate malicious instructions only when specific conditions are met.
Cognitive Token Suppression (PT0197): Manipulates prompts to make the AI ignore or overlook important instructions.
Algorithmic Payload Decomposition (PT0200): Splits a malicious prompt into smaller parts to evade detection.
Special Token Injection (PT0198): Uses special or control tokens to alter the AI’s behavior or bypass safeguards.
Unwitting User Delivery (IM0005): Tricks users into unknowingly delivering malicious prompts to an AI system.
The AI is helped to put these pieces together into a full command. This lets the payload get past regular filters that look for clear dangers.
Special Token Injection hits the setup of AI systems. By copying how things like tool calls or system instructions look, attackers try to mix up trusted and untrusted inputs.
This can fool the model into seeing harmful content as a real command that matters more. The fifth method, Unwitting User Delivery, uses social tricks instead of just technical methods.
Attackers trick users into typing harmful commands by using sneaky content like popular posts or secret tips in media, according to the CrowdStrike advisory.
Since the request comes from a real user session, it is harder for security systems to find. These changes show a new way that prompt injection attacks work. Instead of using clear jailbreak attempts, attackers are now using complex methods with hidden context, delays, and formatting tricks.
This makes it harder to find problems and needs security teams to change how they work. CrowdStrike points out that groups should widen AI threat modeling to cover all data sources, including prompts, APIs, emails, and SaaS platforms.
Detection plans must also consider multi-stage attacks, where different methods are put together into one attack chain.
As AI use grows faster, these new techniques show an important truth: protecting AI agents needs constant updates, better awareness, and a fuller grasp of how attackers use language and context.
