InfoSecBulletin Cybersecurity for mankind
CrowdStrike has shared five new ways to inject prompts, showing the rising danger to AI agents as more organizations use autonomous AI systems. Early risks were mainly about simple chatbot misuse. Now, AI agents can look at websites, access internal data, and carry out commands. This has greatly increased the areas that can be attacked.
Adversaries are adding harmful instructions to the data these agents use. This allows attacks that can take over system actions without clear signs. CrowdStrike has added 18 new techniques to its prompt injection list to tackle this increasing challenge. Now, there are over 200 methods recorded.
Researchers show new technique to bypass AI safety guardrails in Grok and Gemini
About thousands of leaked AWS keys Held Full Admin Rights
US Bank investigates LockBit’s Data Breach Claims
Five new malware families actively targeting Asian Gov.t infra
T-Mobile Cuts Cables to Remove Chiness Salt Typhoon Hackers from Network
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Five new methods show how attackers are improving their tactics to avoid being caught and to gently influence AI systems.
5 New Prompt Injection Techniques
One important technique is Trigger-Activated Rule Addition. In this method, attackers hide instructions that stay inactive until a certain condition or keyword makes them active.
These “sleeping” payloads can bypass initial security reviews and later alter system behavior, such as silently exfiltrating sensitive data once triggered.
Cognitive Token Suppression is a new method. It tries to stop an AI from giving safe answers by limiting its use of refusal or policy words.
By changing the model’s usual safety words, attackers make it more likely to give unclear or wrong answers.
Algorithmic Payload Decomposition is a trick used to avoid detection. Instead of sending a harmful command all at once, attackers split it into smaller parts that seem safe.
Trigger-Activated Rule Addition (PT0201): Hidden triggers activate malicious instructions only when specific conditions are met.
Cognitive Token Suppression (PT0197): Manipulates prompts to make the AI ignore or overlook important instructions.
Algorithmic Payload Decomposition (PT0200): Splits a malicious prompt into smaller parts to evade detection.
Special Token Injection (PT0198): Uses special or control tokens to alter the AI’s behavior or bypass safeguards.
Unwitting User Delivery (IM0005): Tricks users into unknowingly delivering malicious prompts to an AI system.
The AI is helped to put these pieces together into a full command. This lets the payload get past regular filters that look for clear dangers.
Special Token Injection hits the setup of AI systems. By copying how things like tool calls or system instructions look, attackers try to mix up trusted and untrusted inputs.
This can fool the model into seeing harmful content as a real command that matters more. The fifth method, Unwitting User Delivery, uses social tricks instead of just technical methods.
Attackers trick users into typing harmful commands by using sneaky content like popular posts or secret tips in media, according to the CrowdStrike advisory.
Since the request comes from a real user session, it is harder for security systems to find. These changes show a new way that prompt injection attacks work. Instead of using clear jailbreak attempts, attackers are now using complex methods with hidden context, delays, and formatting tricks.
This makes it harder to find problems and needs security teams to change how they work. CrowdStrike points out that groups should widen AI threat modeling to cover all data sources, including prompts, APIs, emails, and SaaS platforms.
Detection plans must also consider multi-stage attacks, where different methods are put together into one attack chain.
As AI use grows faster, these new techniques show an important truth: protecting AI agents needs constant updates, better awareness, and a fuller grasp of how attackers use language and context.
